# Config.action\_controller.session\[:secret\] vs protect\_from\_forgery :secret

**URL:** <https://www.ruby-forum.com/t/config-action-controller-session-secret-vs-protect-from-forgery-secret/177221>\
**Category:** Rails\
**Created:** [October 13, 2009, 6:22pm UTC](https://www.ruby-forum.com/t/config-action-controller-session-secret-vs-protect-from-forgery-secret/177221 "2009-10-13T18:22:05Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![mhfs](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b2d939/32.png) [@mhfs](https://www.ruby-forum.com/u/mhfs)\
**Post date:** [October 13, 2009, 6:22pm UTC](https://www.ruby-forum.com/t/config-action-controller-session-secret-vs-protect-from-forgery-secret/177221/1 "2009-10-13T18:22:05Z")

</div>

What I want to do is share the same session across many Rails  
applications.  
All of them are using Rails 2.2.2. I know that, to share the session,  
it’s  
(supposedly) just a matter of sharing the same key and secret among the  
apps, like this:

config.action\_controller.session = {  
:session\_key =\> ‘\_apps\_session’,  
:secret =\>  
‘71b94f37789bbedf9062616218dab005f2ffae65de2cac6313423a70eeff07189c7694d71d5fc0996’  
}

This being put in config/environment.rb of all the apps you want the  
session  
to be share with.

Now, some of the apps are returning in the HTTP response a session id  
(\_apps\_session=big number) that is different, even though they have the  
same  
session\_key and secret.

One thing that I noted, though, is that these apps are also providing a  
:secret to protect\_from\_forgery, and the number is different from the  
number  
passed to the :secret on config.action\_controller.session[:secret].

What I would like to know is, if I’m setting the secret in  
config.action\_controller.session, do I need to pass it to  
protect\_from\_forgery? Or are they secrets of different nature?

Thanks,

Marcelo.

---

<div class="post-metadata">

**Author:** ![mhfs](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b2d939/32.png) [@mhfs](https://www.ruby-forum.com/u/mhfs)\
**Post date:** [October 13, 2009, 7:33pm UTC](https://www.ruby-forum.com/t/config-action-controller-session-secret-vs-protect-from-forgery-secret/177221/2 "2009-10-13T19:33:31Z")

</div>

On Oct 13, 5:20 pm, Marcelo de Moraes S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> This being put in config/environment.rb of all the apps you want the session  
> to be share with.
> 
> Now, some of the apps are returning in the HTTP response a session id  
> (\_apps\_session=big number) that is different, even though they have the same  
> session\_key and secret.

There is more you need to do: the browser won’t sent the cookie from  
[app1.example.com](http://app1.example.com) when the user’s browser makes a request to  
[app2.example.com](http://app2.example.com). There is an option called something  
like :session\_domain that allows you to set the domain used by your  
session cookie (i think it changed to :domain for 2.3)

> One thing that I noted, though, is that these apps are also providing a  
> :secret to protect\_from\_forgery, and the number is different from the number  
> passed to the :secret on config.action\_controller.session[:secret].
> 
> What I would like to know is, if I’m setting the secret in  
> config.action\_controller.session, do I need to pass it to  
> protect\_from\_forgery? Or are they secrets of different nature?

The two are mostly unrelated if my memory is correct.

Fred