aboutsummaryrefslogtreecommitdiffstats
path: root/guides/source/security.md
diff options
context:
space:
mode:
authorVipul A M <vipulnsward@gmail.com>2016-09-06 22:31:57 +0530
committerGitHub <noreply@github.com>2016-09-06 22:31:57 +0530
commit0c91b166e612d8dba0ededec99cfb39b85d31fbb (patch)
tree4f4dfb81b3b9976c0342dfe6d1aa8cba6b02244e /guides/source/security.md
parent1722397f9a63f74bc7ff633895aec7109568a25b (diff)
parentb9e98d62c24b04937a219285aef69c2a8344beab (diff)
downloadrails-0c91b166e612d8dba0ededec99cfb39b85d31fbb.tar.gz
rails-0c91b166e612d8dba0ededec99cfb39b85d31fbb.tar.bz2
rails-0c91b166e612d8dba0ededec99cfb39b85d31fbb.zip
Merge pull request #26408 from tricknotes/bye-mongrel-from-docs
Remove the word "mongrel" from documents [ci skip]
Diffstat (limited to 'guides/source/security.md')
-rw-r--r--guides/source/security.md2
1 files changed, 1 insertions, 1 deletions
diff --git a/guides/source/security.md b/guides/source/security.md
index 5c3d465220..aea9728c10 100644
--- a/guides/source/security.md
+++ b/guides/source/security.md
@@ -131,7 +131,7 @@ It works like this:
* The user takes the cookie from the first step (which they previously copied) and replaces the current cookie in the browser.
* The user has their original credit back.
-Including a nonce (a random value) in the session solves replay attacks. A nonce is valid only once, and the server has to keep track of all the valid nonces. It gets even more complicated if you have several application servers (mongrels). Storing nonces in a database table would defeat the entire purpose of CookieStore (avoiding accessing the database).
+Including a nonce (a random value) in the session solves replay attacks. A nonce is valid only once, and the server has to keep track of all the valid nonces. It gets even more complicated if you have several application servers. Storing nonces in a database table would defeat the entire purpose of CookieStore (avoiding accessing the database).
The best _solution against it is not to store this kind of data in a session, but in the database_. In this case store the credit in the database and the logged_in_user_id in the session.