Hacker News Reader

The CookieStore isn't broken but you do need to add code to fix the issue? I have no experience with Rails but I really hadn't expected that sessions would be client-side only.

View on HN

FWIW, the fact that the default session store is client-side only is mentioned in the overview for beginners:

http://guides.rubyonrails.org/action_controller_overview.htm...

It's also mentioned in the security guide: http://guides.rubyonrails.org/security.html#session-storage

Storing IDs in session cookies is not something the Rails framework introduced. Smh. It's easier to blame someone else's code though.

Reply on news.ycombinator.com