Rails' default session store (CookieStore) serializes, encrypts, and sends session data to the browser as a cookie — it is not server-side memory. Storing Active Record objects in the session causes CookieOverflow errors (4 KB limit) that surface in middleware, not in the controller. The post traces the full serialization pipeline from Ruby hash to encrypted Set-Cookie header, explains why CookieStore is the default in multi-process/multi-worker production environments, and covers the invalidation problem: since cookies live on the client, server-side revocation requires a session token pattern where a database column determines whether a token is still valid. The core rule: store identity (IDs, tokens) in the session, never application state or objects.
