Also, only the server is allowed to put things into the session cookie, which is enforced by checking the cookie&#x27;s signature which is generated from a key that only the server is supposed to know. Using a &quot;native object&quot; serializer (like Marshal or pickle) for session data and storing the secret token in a file that is easy to accidentally check into source control are both <i>stupid</i> things to do, but they&#x27;re also common mistakes and you have to do both at the same time for this attack to work, so it seems quite overboard to suggest it was done deliberately.