News for hackers. Stuff that matters.

A comment on Is it OK to hold credit card numbers in cookies, Santander?. Parent comment

Re:Is it OK to hold credit card numbers in cookies, Santander? by luos on Monday October 15, 2012 @02:19PM (#4656364)
I dont know either why is this the default in rails. In PHP you only have a session id in a cookie. When I first saw how it works in rails (ruby?) it blew my mind.

I don't want to think about how many rails user don't know this and send sensitive data to the client.

[ Parent | on HN ]
Re:Is it OK to hold credit card numbers in cookies, Santander? by phil on Monday October 15, 2012 @05:15PM (#4657196)
The advantage -- and it's often a big one -- is that you don't have to have a corresponding server component to translate session id to session state. The state is all in the client.

Edit: wouldn't have written this if I'd seen FooBarWidget's more detailed remarks first.

[ Parent | on HN ]
Re:Is it OK to hold credit card numbers in cookies, Santander? by Firehed on Monday October 15, 2012 @07:24PM (#4657637)
"Never trust the client"
[ Parent | on HN ]
Re:Is it OK to hold credit card numbers in cookies, Santander? by nessus42 on Monday October 15, 2012 @08:28PM (#4657822)
The session information is cryptographically signed, so you don't have to trust it! These stateless server frameworks are just using the client as a state cache.
[ Parent | on HN ]