protect rails w/cookie-session agains #wasbook 4.8.2 case.

gistfile1.rb

require 'digest/sha1'

module SecureCookieViolationProtect
  extend ActiveSupport::Concern

  included do
    before_filter do
      return true unless request.ssl?
      return true if secure_cookie_token(session[:token]) == cookies[:secure_cookie_token]

      head(:bad_request)
    end
  end

  def reset_session
    super

    session[:token] = SecureRandom.hex
    cookies[:secure_cookie_token] = {value: secure_cookie_token(session[:token]), secure: true}
  end

  private

  def secure_cookie_token(token)
    Digest::SHA1.hexdigest([token, Rails.application.config.secret_token].join("\0"))
  end
end