yourmysin

3 ms·

1. 1.▲
   by yourmysin 12y ago

   Another draw back of using tokens instead of cookies is that tokens don't offer any security mechanisms similar to the Secure and HttpOnly flags for Cookies. Without these security controls they're easier for an attacker to interc
2. 2.▲
   by yourmysin 12y ago

   Exactly. The session information is stripped from the request, but the session is not really "destroyed." Rails leverages client side sessions, which are signed to prevent tampering. Because of this nature, however, sessions can b
3. 3.▲
   by yourmysin 12y ago

   You're correct. Thankfully Rails4 provides the option of doing this by default, but in my opinion, it should still be default behavior, and should not require an option to the protect_from_forgery method. Unfortunately, the Rails team