# Are class variables session specific? **URL:** \ **Category:** Rails\ **Created:** [January 30, 2010, 8:25am UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576 "2010-01-30T08:25:52Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\ **Post date:** [January 30, 2010, 8:25am UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576/1 "2010-01-30T08:25:52Z")
I’m trying to wrap my head around what information is session specific and what isn’t. If I do User::x = 1 will User::x == 1 for all sessions on the same machine? I think it is the same on the same, but I’d like confirmation. ---
**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\ **Post date:** [January 30, 2010, 9:45am UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576/2 "2010-01-30T09:45:13Z")
I believe class variables are shared between sessions and are unsafe storage for session-specific information. If you’re looking for session isolated variables which can be accessed anywhere in your app, try using Thread.current. ---
**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\ **Post date:** [January 30, 2010, 11:10am UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576/3 "2010-01-30T11:10:05Z")
On Jan 30, 7:25 am, Ralph S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I’m trying to wrap my head around what information is session specific > and what isn’t. > > If I do > User::x = 1 > will User::x == 1 for all sessions on the same machine? > > I think it is the same on the same, but I’d like confirmation. It will be the same for all requests handled by that particular instances. If you have a pool of passenger/mongrel/thin/unicorn/etc instances then each one would have a different value. Fred ---
**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\ **Post date:** [January 30, 2010, 1:10pm UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576/4 "2010-01-30T13:10:50Z")
Frederick C. wrote: > If you have a pool of passenger/mongrel/thin/unicorn/etc > instances then each one would have a different value. Sigh … more things for me to learn. Thanks for point that stuff out. ---
**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\ **Post date:** [January 30, 2010, 10:07pm UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576/5 "2010-01-30T22:07:16Z")
On Sat, Jan 30, 2010 at 5:08 AM, Frederick C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > I think it is the same on the same, but I’d like confirmation. > > It will be the same for all requests handled by that particular > instances. If you have a pool of passenger/mongrel/thin/unicorn/etc > instances then each one would have a different value. And different requests for the same session might well run on different instances, so see different values. Same problem with the suggestion to use thread local variables made by a responder to this thread. I’m pretty sure that the only way to deal with values which have to be seen between requests is to either put them in some persistent storage on the server (e.g. the DB, SQL or noSQL), or in the session and let the browser give it back to you. – Rick DeNatale Blog: [http://talklikeaduck.denhaven2.com/](http://talklikeaduck.denhaven2.com/) Twitter: [http://twitter.com/RickDeNatale](http://twitter.com/RickDeNatale) WWR: [http://www.workingwithrails.com/person/9021-rick-denatale](http://www.workingwithrails.com/person/9021-rick-denatale) LinkedIn: [Rick DeNatale - Developer - IBM | LinkedIn](http://www.linkedin.com/in/rickdenatale) ---
**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\ **Post date:** [January 31, 2010, 12:06am UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576/6 "2010-01-31T00:06:04Z")
> I’m pretty sure that the only way to deal with values which have to be > seen between requests is to either put them in some persistent storage > on the server (e.g. the DB, SQL or noSQL), or in the session and let > the browser give it back to you. So … are “params” visible to 3rd parties if session management is done via a cookie-based approach? If using ActionController::Base.session\_store = :active\_record\_store a better way to do things? If so … why isn’t this the default? ---
**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\ **Post date:** [January 31, 2010, 12:14am UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576/7 "2010-01-31T00:14:15Z")
On Jan 30, 2010, at 3:06 PM, Ralph S. wrote: > > I’m pretty sure that the only way to deal with values which have to be > > seen between requests is to either put them in some persistent storage > > on the server (e.g. the DB, SQL or noSQL), or in the session and let > > the browser give it back to you. > > So … are “params” visible to 3rd parties if session management is done > via a cookie-based approach? > If using ActionController::Base.session\_store = :active\_record\_store a > better way to do things? If so … why isn’t this the default? This is kind of old news, but read here to see why your cookie-based sessions are tamper resistant: [http://www.rorsecurity.info/2007/11/20/rails-20-cookies/](http://www.rorsecurity.info/2007/11/20/rails-20-cookies/) With other session stores, you had to manually clean up periodically – sweep up the expired cookies. It’s waaaaaaaay easier this way. ---
**Author:** ![ralphshnelvar](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/e19adc/32.png) [@ralphshnelvar](https://www.ruby-forum.com/u/ralphshnelvar)\ **Post date:** [January 31, 2010, 12:17am UTC](https://www.ruby-forum.com/t/are-class-variables-session-specific/182576/8 "2010-01-31T00:17:11Z")
On Jan 30, 2010, at 3:06 PM, Ralph S. wrote: > So … are “params” visible to 3rd parties if session management is done > via a cookie-based approach? > If using ActionController::Base.session\_store = :active\_record\_store a > better way to do things? If so … why isn’t this the default? Also read here, and in particular, consider DHH’s comment: > **[Latest Relevance Open Source: encrypted cookie store](https://cognitect.com/blog/2008/1/27/latest-relevance-open-source-encrypted-cookie-store)** > > Aaron just released our latest open source project, EncryptedCookieStore. It turns out that the default cookie session store for Rails is insecure in the wor...