Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

I'm sure Authlogic/Devise leaks information about itself in other places than just the session data (e.g. query params, routes).

Besides, this only adds security through obscurity and doesn't actually make it any more secure.



Of course, I agree with you that the goal should not be to add sensitive information to session cookies. But if it's possible to encrypt, and it might provide an attacker with information, why not? I'm interested in the trade-offs. Here's the pull that adds it, I believe: https://github.com/rails/rails/pull/8112/commits


The obvious trade-off is that now I can't see what's in the cookie.


You can quite happily set individual cookies[1] in a very similar way to sessions. You can also output or log the session object on any web page you want to.

If certain data being user-visible is a feature rather than a side effect, the session was the wrong place for you to be putting it.

[1]: http://api.rubyonrails.org/classes/ActionDispatch/Cookies.ht...


In this case the "I" in question is the user for an arbitrary website. Obviously this is not a huge issue, but it's worth noting that this will make many sites a little harder to reverse-engineer. Of course many people might see this as a plus rather than a minus, so make of it what you will.




Consider applying for YC's Summer 2026 batch! Applications are open till May 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: