Rails Dispatch | Presented by Engine Yard

Rails Dispatch | Presented by Engine Yard:

The entire attack vector neatly fits into a tweet, and could easily get even smaller if space was as a bigger premium. If the user viewing this content is an admin user, the attacker just got the ability to masquerade as that admin user. This means that even content that will only appear in admin sections of your website generated by arbitrary users can present

Full article: http://www.railsdispatch.com/posts/security