ministryofjustice/peoplefinder — pull request #21 by Najaf (2014-11-10 11:23:14+00:00)
Title: Changes cookie serializer to :hybrid

Serialising sessions using `Marshal` leaves Rails applications open to remote code execution should the `secret_key_base` be divulged. This change limits the damage to being able to read/write session data only.

The `:hybrid` option will transparently convert sessions from `Marshal` to `JSON` formats, so existing sessions will still be accepted.