title: Rails: Where is message digest of sessions using default CookieStore
body: <p>According to <a href="https://stackoverflow.com/questions/10353861/security-of-rails-authentication-with-sessionuser-id">this question</a>,  session can be edited by user. But <a href="https://stackoverflow.com/a/10355540/1066668">this answer</a> suggests it's safe to store user id.</p>
  
  <p>From <a href="http://apidock.com/rails/ActionDispatch/Session/CookieStore" rel="nofollow noreferrer">Rails document</a></p>
  
  <blockquote>
    <p>A message digest is included with the cookie to ensure data integrity: a user cannot alter his user_id without knowing the secret key included in the hash</p>
  </blockquote>
  
  <p>With <code>&lt;%= debug(session) %&gt;</code> embedded in my page and the session value in Chrome's Developer tools, I can't find the message digest in the session cookie. If I login as user A and then login as user B, the session cookie remains the same excecpt <code>user_id</code> value.</p>
  
  <p>So where is the <strong>message digest</strong> or do I need some configuration? The auto-generated secret_token exists in <code>config/initializers/secret_token.rb</code>. Is it stored in the server's memory and hash the session value on every request?</p>