title: Rails 3 ActiveRecordStore session_id tampering
body: <p>I am co-developing a simple web app in <strong>Rails 3.0.9</strong> and I have realized that there is a possible session_id tampering possible via malicious request. Mind the fact, that this is my first RoR application, so I could be totally wrong in my conceptions.</p>
  
  <p>Current application functionality requires sessions so I turned to ActiveRecordStore session storage, <a href="https://stackoverflow.com/questions/2588241/rails-sessions-current-practices-especially-for-rails-3">installed</a> it and started testing in primitive workflows. I noticed that Rails framework creates cookie with the name <code>_session_id</code> and value of some random hash-like string (in DB SESSION table this string corresponds to <code>session_id</code> column). </p>
  
  <p>If that value in the cookie is changed, for example with Firebug, current session id changes to one provided with cookie's data (inspected with <code>request.session_options[:id]</code>), and the change is propagated to the database table, creating new session record with aforementioned parameters.</p>
  
  <p>While this brings no implications on a variables of the session, the session id have deviated from its usual hash-like appearance to a user tampered one.</p>
  
  <p>Here is the question - how this behavior can be detected or preferably prevented?</p>