It's also mentioned in the security guide: http://guides.rubyonrails.org/security.html#session-storage