3 ms·
Exactly. The session information is stripped from the request, but the session is not really "destroyed." Rails leverages client side sessions, which are signe
by yourmysin 12y ago
Exactly. The session information is stripped from the request, but the session is not really "destroyed."
Rails leverages client side sessions, which are signed to prevent tampering. Because of this nature, however, sessions can be constantly replayed.
- gingerlime 12y agoBut most apps move away from client-side sessions and use some kind of a session store (in memory, redis, memcache typically). In this case, the session.destroy should really destroy the session, meaning the user will be logged out (that's as far as I can tell without actually trying it)