# Cgi::session

**URL:** <https://www.ruby-forum.com/t/cgi-session/100503>\
**Category:** Ruby\
**Created:** [July 29, 2006, 5:32pm UTC](https://www.ruby-forum.com/t/cgi-session/100503 "2006-07-29T17:32:33Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![tma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ed655f/32.png) [@tma](https://www.ruby-forum.com/u/tma)\
**Post date:** [July 29, 2006, 5:32pm UTC](https://www.ruby-forum.com/t/cgi-session/100503/1 "2006-07-29T17:32:33Z")

</div>

how are you supposed to delete the session data from the server?  
I made the assumption that session.delete would do this, but it’s not  
removing the files.

Any practices out there anyone care to share?

---

<div class="post-metadata">

**Author:** ![tma](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/ed655f/32.png) [@tma](https://www.ruby-forum.com/u/tma)\
**Post date:** [February 18, 2007, 9:52pm UTC](https://www.ruby-forum.com/t/cgi-session/100503/2 "2007-02-18T21:52:48Z")

</div>

Tom A. wrote:

> how are you supposed to delete the session data from the server?  
> I made the assumption that session.delete would do this, but it’s not  
> removing the files.
> 
> Any practices out there anyone care to share?

I had exactly the same problem. All the docs show clearing individual  
items from the session, but I have not seen a single example of using  
session.delete. I have proof it is does not work. I wouldn’t have been  
debugging if it did :-), but here’s the proof. I stopped right after  
the ‘session.delete’ and one of my keys was still there.

[40, 49] in ./script/…/config/…/app/controllers/login\_controller.rb  
40 session[:shortname] = nil  
41 session[:auth\_lvl] = nil  
42 session[:auth\_desc] = nil  
43 session.delete  
44 debugger  
=\> 45 redirect\_to(:action =\> “login”)  
46 end  
47 end  
(rdb:119) p session[:san\_names]  
[“IBM\_2109\_F32\_2”]

Well, I continued to hack and found the solution. Two of them, really.

When I looked at the source code to CGI#Session#delete(), I saw that it  
did not actually remove the hash keys from the current object. I added  
the following code to my login\_controller.rb to open up the CGI::Session  
class to add the clear() method.

class CGI::Session  
def clear  
@data.clear  
@dbman.delete  
@dbprot.clear  
end  
end

I found that I could issue the statement ‘session.clear’ during logout,  
and the session variable was completely clean. However, in a Rails  
environment this is a little too drastic. Rails uses the ‘flash’ key to  
save a hash which contains error message notifications. The ‘clear’  
method wipes that out too. So I added an ‘each’ method to CGI::Session  
so that I could iterate over the keys and nil out them out selectively.  
The following code accomplishes the task.

class CGI::Session  
def each  
@data ||= @dbman.restore  
if block\_given?  
@data.keys.each do |key|  
yield key  
end  
else  
@data.keys  
end  
end  
end

In my login\_controller.rb the logout method now does the following,  
which is a complete solution to my problem:

session.each do |key|  
session[key] = nil unless key == ‘flash’  
end

All the keys are set to nil rather than actually removed, but they are  
effectively gone. The session file shows a drastic reduction in size,  
and the next time I log in, all remnants of the previous session are  
gone.

Me gusta Ruby!