# Config.action\_controller.session\_options\[:cookie\_only\] = true

**URL:** <https://www.ruby-forum.com/t/config-action-controller-session-options-cookie-only-true/178506>\
**Category:** Rails\
**Created:** [November 5, 2009, 4:04pm UTC](https://www.ruby-forum.com/t/config-action-controller-session-options-cookie-only-true/178506 "2009-11-05T16:04:02Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![suki](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/94ad74/32.png) [@suki](https://www.ruby-forum.com/u/suki)\
**Post date:** [November 5, 2009, 4:04pm UTC](https://www.ruby-forum.com/t/config-action-controller-session-options-cookie-only-true/178506/1 "2009-11-05T16:04:02Z")

</div>

Recently, I got this security vulnerability on my app:

Ruby on Rails Multiple Method Session Fixation  
Synopsis :

```
  The remote web server is affected by a session fixation

```

vulnerability.

```
  Description :

  The web server on the remote host appears to be a version of

```

Ruby on  
Rails that supports URL-based sessions. An unauthenticated  
remote  
attacker may be able to leverage this issue to obtain an  
authenticated  
session.

```
  Note that Ruby on Rails version 1.2.4 was initially supposed to
  address this issue, but its session fixation logic only works

```

for the  
first request, when CgiRequest is first instantiated.

```
  See also :

  http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
  http://www.nessus.org/u?2f5b72e6
  http://dev.rubyonrails.org/ticket/10048
  http://www.nessus.org/u?1eeea9de

  Solution :

  Upgrade to Ruby on Rails version 1.2.6 or later and make sure
  'config.action_controller.session_options[:cookie_only]' is set

```

to  
‘true’ in the ‘config/environment.rb’ file.

I checked my rails version: it is already 1.2.6. Then I un-comment  
this line in environment.rb  
config.action\_controller.session\_options[:cookie\_only] = true

I got the following:

Error message:  
You have a nil object when you didn’t expect it! You might have  
expected an instance of Array. The error occurred while evaluating nil.  
[]=  
Exception class:  
NoMethodError

Can anyone help me understand what is going on here?