title: user_Id Session Secure ? Hartl
body: <p>In Hartl's tutorial we set the session as a cookie stored as a hashed version of the user_id. We then compare the unhashed cookie to a user.id</p>
  
  <p><a href="https://www.railstutorial.org/book/log_in_log_out" rel="nofollow">https://www.railstutorial.org/book/log_in_log_out</a></p>
  
  <pre><code>def log_in(user)
      session[:user_id] = user.id
    end
  </code></pre>
  
  <p>Is this secure?  Couldn't I session hash random user_id numbers to generate a cookie myself that I could then use to log in as another random user?</p>