There is nothing that forces you to use the cookie to store session info..read below: -------------------------- * Introduce a cookie-based session store as t

There is nothing that forces you to use the cookie to store session info..read below: -------------------------- * Introduce a cookie-based session store as the Rails default. Sessions typically contain at most a user_id and flash message; both fit within the 4K cookie size limit. A secure hash is included with the cookie to ensure data integrity (a user cannot alter his user_id without knowing the secret key included in the hash). If you have more than 4K of session data or don't want your data to be visible to the user, pick another session store. Cookie-based sessions are dramatically faster than the alternatives.