I cannot figure out how to let session cookies expire after let’s say
two years. Note that I am not using CookieStore. I mean the cookie
referencing the Active Record Session.
Session cookies are supposed to expire when you quit the browser!
Ordinary cookies however are another matter entirely. I asked a
similar question (how to get non session cookies to be stored in the
database) a few days ago and got no answer.
Thank you for your answer! However, I am sure it is possible to make
these session cookies stay! The option exists, and it always worked for
me until 2.3! I know ActiveRecord Session Store has been refactored in
this version (at least renamed), and I am sure this is merely a question
of setting the option in the wrong place!
Any idea?
Thank you
Nauhaie
Peter H. wrote:
Session cookies are supposed to expire when you quit the browser!
Ordinary cookies however are another matter entirely. I asked a
similar question (how to get non session cookies to be stored in the
database) a few days ago and got no answer.
What I wonder is what are the advantages of using an active record
session store?
I assume people do this for a few reasons:
Need to persist sessions between browser launches. I would consider
this in only in very rare cases. It’s my opinion that session cookies in
their current form are even too lenient. An HTML 5 local session storage
object seems like the ideal choice, given that they limit a session to a
single browser window instance, having the same life-cycle and
encapsulation as the window. They also seem to fix a common problem with
cookies leaking out to other domains. Local storage objects are bound to
the domain that created them without the loopholes cookies allow. Too
bad this isn’t yet a viable option, but hopefully one day will be.
Need to store more that 4K of session data. In most cases this
shouldn’t be an issue given that it’s good practice to keep sessions as
small as possible. And again HTML 5 local session storage eliminates
this limitation (something else to look forward to in the future).
Need to store sensitive data inside session objects. I cringe as I
write that. It just sounds like such a bad idea. But, I suppose that’s
why encryption was invented.