Question

I have a really special login feature in my app, so instead of plugins I use my own code.

In my controller I have something like

def login
  ...
  session[:customer_id] = id
end

I use CookieStore (as default). So is it secure? What if somebody edit cookies? Can he impersonates somebody with another id?

Answer 1

A message digest is included with the cookie to ensure data integrity: a user cannot alter his user_id without knowing the secret key included in the hash. New apps are generated with a pregenerated secret in config/environment.rb. Set your own for old apps you‘re upgrading.

See http://api.rubyonrails.org/v2.3.8/classes/ActionController/Session/CookieStore.html. Please also pay attention to this sentence :

If you have more than 4K of session data or don‘t want your data to be visible to the user, pick another session store.

In your situation, it certainly doesn’t matter and you can use CookieStore without fear.