title: How to encrypt the session cookie in rails 4
body: <p>Let us say I do something like this in my application:</p>
  
  <pre><code>session[user_id] = 1
  </code></pre>
  
  <p>According to the video I watched (referenced below): In rails 4: </p>
  
  <ul>
  <li><p>the session cookie by default is encoded but not encrypted.  Meaning:  The session cookie is not able to be altered because of the digest value.  If the savvy user alters the payload somehow then it will render the session cookie useless.</p></li>
  <li><p>Regarding the fact that the session cookie is encoded, but not encrypted.  Even though the savvy user cannot <em>successfully alter</em> the session cookie, the savvy user is able to still <em>read</em> the contents.</p></li>
  </ul>
  
  <p>I know that the convention is to never store anything confidential in a cookie: whether that cookie is a regular cookie or a session cookie.  However, for added security:  How can one encrypt the session cookie so that its contents are not able to be read by that savvy user at all?</p>
  
  <p>Furthermore: How can I changed the default behavior of the session cookie from being just encoded by default to being encrypted as well?</p>
  
  <p><strong>Background:</strong>  I worked through the Lynda.com course "Ruby on Rails 4 Essential Training."  I got to the "Cookies and Sessions" video.</p>
  
  <p>Also: <a href="http://api.rubyonrails.org/classes/ActionDispatch/Session/CookieStore.html" rel="nofollow">relevant rails documentation</a>.</p>