Redmine

If you can access a user's cookie, you'd probably have access to the credentials they posted to authenticate as well.

You should be enabling the HTTPS protocol option in the Redmine administration menu which then ensures the _redmine_session cookie is a secure cookie and cannot be intercepted.

Thank you for your answers. The first do not think this solves the problem , but I'll try both and tell them whether or not addressed.

I explain a little better what probe done, for example we have a redmine is redmine.com , and a project called X, entered from any browser with a valid user, and access to project X. By accessing saved the contents of the cookie for use in another browser.

Open a new browser screen enter Loguin , then loaded cookie previously obtained in the new browser with content that had copied . Once you do this directly access a project X, without entering username and password.

Redmine is Rails application.
I think you would better ask Rails community.
http://rubyonrails.org/community/