diff --git a/actionpack/lib/action_controller/base.rb b/actionpack/lib/action_controller/base.rb
index 07fed278e2f4451365a3a944632038c049d01bb3..5249fd035a4bcccca6f5c2cce6cbdf290ce0e60f 100755
--- a/actionpack/lib/action_controller/base.rb
+++ b/actionpack/lib/action_controller/base.rb
@@ -162,17 +162,26 @@ def initialize(message = nil)
# For removing objects from the session, you can either assign a single key to nil, like session[:person] = nil, or you can
# remove the entire session with reset_session.
#
- # By default, sessions are stored on the file system in RAILS_ROOT/tmp/sessions. Any object can be placed in the session
- # (as long as it can be Marshalled). But remember that 1000 active sessions each storing a 50kb object could lead to a 50MB store on the filesystem.
- # In other words, think carefully about size and caching before resorting to the use of the session on the filesystem.
+ # Sessions are stored in a browser cookie that's crytographically signed, but unencrypted, by default. This prevents
+ # the user from tampering with the session but also allows him to see its contents.
#
- # An alternative to storing sessions on disk is to use ActiveRecordStore to store sessions in your database, which can solve problems
- # caused by storing sessions in the file system and may speed up your application. To use ActiveRecordStore, uncomment the line:
+ # Do not put secret information in session!
+ #
+ # Other options for session storage are:
+ #
+ # ActiveRecordStore: sessions are stored in your database, which works better than PStore with multiple app servers and,
+ # unlike CookieStore, hides your session contents from the user. To use ActiveRecordStore, set
#
# config.action_controller.session_store = :active_record_store
#
# in your environment.rb and run rake db:sessions:create.
#
+ # MemCacheStore: sessions are stored as entries in your memcached cache. Set the session store type in environment.rb:
+ #
+ # config.action_controller.session_store = :mem_cache_store
+ #
+ # This assumes that memcached has been installed and configured properly. See the MemCacheStore docs for more information.
+ #
# == Responses
#
# Each action results in a response, which holds the headers and document to be sent to the user's browser. The actual response
diff --git a/actionpack/lib/action_controller/session_management.rb b/actionpack/lib/action_controller/session_management.rb
index 207db90c83c8249c73277a3a75d900b0a19d4588..fabb6e7f604a46fc93d4cc0483c57444adec9f15 100644
--- a/actionpack/lib/action_controller/session_management.rb
+++ b/actionpack/lib/action_controller/session_management.rb
@@ -16,9 +16,9 @@ def self.included(base)
end
module ClassMethods
- # Set the session store to be used for keeping the session data between requests. The default is using the
- # file system, but you can also specify one of the other included stores (:active_record_store, :drb_store,
- # :mem_cache_store, or :memory_store) or use your own class.
+ # Set the session store to be used for keeping the session data between requests. By default, sessions are stored
+ # in browser cookies (:cookie_store), but you can also specify one of the other included stores
+ # (:active_record_store, :p_store, drb_store, :mem_cache_store, or :memory_store) or your own custom class.
def session_store=(store)
ActionController::CgiRequest::DEFAULT_SESSION_OPTIONS[:database_manager] =
store.is_a?(Symbol) ? CGI::Session.const_get(store == :drb_store ? "DRbStore" : store.to_s.camelize) : store