"You need to set up a session middleware *before* Rack::Protection::SessionHijacking" about rack-protection

[SirRawlins]

+1

[leebrooks0]

The readme suggests using config.ru, but the Rails docs say it should be done in application.rb

# config/application.rb
config.middleware.use Rack::Protection

I have configured it like this and don't have any problems...
See: http://guides.rubyonrails.org/rails_on_rack.html#configuring-middleware-stack

[SirRawlins]

Thanks @leebrooks0 I'll give this a shot, and assuming it works I'll send a pull request in to update the README.

[rkh]

PR would be much appreciated. I'll give this some more thought, maybe there's a better way without making things less secure.

[janko]

Yes, in Rails you have to use its middleware API, because there the session middleware (Rack::Session::Cookie) is already added, while in config.ru it's not yet. Isn't this problem solved? :)

[zzak]

I commited 82e72ba which allows you to skip the session based middleware by passing a :without_session => true option.