Hacker News Reader

Cookie store has always been signed and in rails 4 it's encrypted.

Very sloppy it wasn't encrypted from day 1 imo.

Day 1 was eight years ago. Care to tell which popular web frameworks did that then?

most popular web frameworks don't put data in the cookie, signed or not. yes it introduces different problems, but avoids this one.