Take the 2-minute tour ×  I was wondering if anyone knows what
the most secure user access plugin for Rails is, and if any of
them prevent session fixation?  share|improve this question add
comment  1 Answer  up vote 2 down vote accepted  From the Ruby
on Rails security Guide as long as you're using the
reset_session command during the authentication process, you
should be mitigating against session fixation attacks. In
general with a rails app. if you're only creating the session
when the user logs in and you're issuing a new Session ID at
that point, you shouldn't have too many problems with session
fixation.  share|improve this answer add comment  Your Answer