Security of Rails authentication with session[:user_id]

Question

I've noticed a lot of Rails authentication tutorials store the user ID in session[:user_id] to remember the user and authenticate them. Assuming there is somewhere in the app that user_ids are exposed publicly (URLs, property on an HTML attribute, etc.), isn't this insecure since I could just edit my session cookie to use someone else's user_id? Am I missing something here?

Accepted Answer

According to the Rails Security Guide: "To prevent session hash tampering, a digest is calculated from the session with a server-side secret and inserted into the end of the cookie."

So it looks like the Session can be presumed to be safe from the user tampering with it (assuming our server side secret is kept safe). However, a user still can read anything in the session hash, so we wouldn't want to store sensitive information.

Security of Rails authentication with session[:user_id]

Solution

Problem