Emotions run high, on both sides, and I've been on both sides of it at various points in my life. I recognize the patterns of the bad arguments made by both sides (by A: "of course you don't do that," "this requires something else bad to happen," "that's a problem with bad coders", "you are an idiot"; and by B: "every potential issue is worth full attention," "you should always stop your developers from breaking things," "you can't fix things with obscurity!!!1," "you'll be sorry", "you are an idiot.").
My hope is that expiration will be soon baked-in (or easier to bake in), after reading https://github.com/rails/rails/pull/11168
Completely agreed - that's the gist of the DB bits there. Right now, you can terminate a compromised AR-backed session by logging out, but if you lose that session ID, then you have no control over the compromised session. If someone jacks your SID while you're on a public terminal, using ARStore alone isn't going to save you.
Who in late 2013 (with enough clue to care about this issue) is still using non-secure-flag cookies for anything even remotely important?!
local_env = !(Rails.env.test? || Rails.env.development?)
MyApp::Application.config.session_store(:cookie_store, {
key: '_my_app_session',
secure: local_env, # ... or just true
})