rack-protection-session-hijacking.html

<dl class="rdoc-list note-list"><dt>Prevented attack
<dd>
<p>Session Hijacking</p>
</dd><dt>Supported browsers
<dd>
<p>all</p>
</dd><dt>More infos
<dd>
<p><a href="http://en.wikipedia.org/wiki/Session_hijacking">en.wikipedia.org/wiki/Session_hijacking</a></p>
</dd></dl>

<p>Tracks request properties like the user agent in the session and empties the session if those properties change. This essentially prevents attacks from Firesheep. Since all headers taken into consideration can be spoofed, too, this will not prevent determined hijacking attempts.</p>