Lessons learned are enumerated at the bottom for those who want the tl;dr
Lately, I've noticed that the Rails app I am working on does this funny little thing where it logs everyone out every time we deploy. Sorry, ppl!
I wanted to fix this, and so I went looking into our auth system. Turns out, we store the user's id in a session var and find the user based on that value. WHAT? You might say. Well..it is totally OK because my friend Rails encrypts all session vars.
To prevent session hash tampering, a digest is calculated from the session with a server-side secret (secrets.secret_token) and inserted into the end of the cookie.