Rails 4: Does Devise address session fixation by resetting session after login?

Question

I'm going through the Rails Security Guide and I'm trying to figure out if I need to address session fixation by resetting the user's session after login and assigning the new session to the user.

I'm using Devise 3.4.1 right now. Does Devise automatically take care of this? If not, what do I need to change to protect my site against session fixation?

Answer 1

Devise is not vulnerable to session fixation attacks, as of this commit on November 20th, 2010 ( related blog post ).

This is confirmed by Jose Valim, one of its authors, in a blog post about CSRF token fixation attacks.