Rails 如何检查 session_id cookie 是否被客户端更改
在rails中，如果正确设置会话配置，它将生成一个session_id，然后在渲染网页后，seesion_id将通过cookie存储在客户端上；但是，如果客户端在向 Web 服务器发送请求之前更改了 cookie 值，rails 如何检查更改？现在我找不到任何rails检查更改的线索，如果不检查并且更改后的seesion_id存在于Web服务器会话存储中，则其他会话的数据将为当前浏览器用户显示。
如果有人清楚这个问题，你能为我解释一下吗？先感谢您。
In rails it will generate a session_id if properly set up session configuraions, then after rendering the web page the seesion_id will store on client with cookie; however if the cookie value is changed by client before sending request to web server, how rails to check the change? Now i can not find any clues for rails to check the change, if it doesn't to check and the changed seesion_id is existed in web server session store, other session's data will be dispalyed for the current browser user.
If someone is clear on the question can you explain it for me? thank you in advance.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
该 cookie 是经过加密签名的。请参阅：
https://github.com/rails /rails/blob/master/actionpack/lib/action_dispatch/middleware/cookies.rb
请注意，对 cookie 进行签名并不意味着对其进行加密。用户可以通过一些摆弄来查看其会话的内容，但无法在不破坏签名的情况下更改它。
如果您想对用户隐藏会话内容，请不要使用 cookie 存储。
The cookie is cryptographically signed. See:
https://github.com/rails/rails/blob/master/actionpack/lib/action_dispatch/middleware/cookies.rb
Note that signing the cookie doesn't mean the same thing as encrypting it. The user can see the contents of their session with a bit of fiddling but can't alter it without breaking the signature.
If you want to hide the contents of your sessions from your user, don't use the cookie store.