# Cookie based session management problems

**URL:** <https://www.ruby-forum.com/t/cookie-based-session-management-problems/87318>\
**Category:** Rails\
**Created:** [March 1, 2007, 6:27pm UTC](https://www.ruby-forum.com/t/cookie-based-session-management-problems/87318 "2007-03-01T18:27:14Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![klancaster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f1d935/32.png) [@klancaster](https://www.ruby-forum.com/u/klancaster)\
**Post date:** [March 1, 2007, 6:27pm UTC](https://www.ruby-forum.com/t/cookie-based-session-management-problems/87318/1 "2007-03-01T18:27:14Z")

</div>

Edge has a change in default behaviour where sessions are stored as  
cookies instead of in the file system. This was a pleasant surprise when  
I synced up, fired up my app, and nothing worked. Ah, life on the edge.

I’m sure I’m just missing something, but I can’t get sessions to survive  
the first redirect. I added the following code to environment.rb, based  
on Ryan’s ([http://www.ryandaigle.com/](http://www.ryandaigle.com/)) note:

config.action\_controller.session = {  
:session\_key =\> ‘\_\<%= app\_name %\>\_session’,  
:secret =\> ‘\<%= CGI::Session.generate\_unique\_id(app\_name) %\>’  
}

The problem is probably related to the fact that the embedded ruby is  
not getting processed. The generated cookie is

NAME: \_\<%  
VALUE app\_name %\>\_session…

What am I missing? (I’m in dev mode, btw).

TIA,  
Keith

---

<div class="post-metadata">

**Author:** ![klancaster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f1d935/32.png) [@klancaster](https://www.ruby-forum.com/u/klancaster)\
**Post date:** [March 1, 2007, 7:29pm UTC](https://www.ruby-forum.com/t/cookie-based-session-management-problems/87318/2 "2007-03-01T19:29:55Z")

</div>

On 3/1/07, Keith L. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> :session\_key =\> ‘\_\<%= app\_name %\>\_session’,  
> :secret =\> ‘\<%= CGI::Session.generate\_unique\_id(app\_name) %\>’  
> }
> 
> The problem is probably related to the fact that the embedded ruby is  
> not getting processed. The generated cookie is
> 
> NAME: \_\<%  
> VALUE app\_name %\>\_session…
> 
> What am I missing? (I’m in dev mode, btw).

\<% %\> is used for erb. However, since config files use ruby, you’ll  
have to use #{} for variables.

The reason Ryan’s sample has that is because he’s taking code from the  
rails app generator. Once generated with a command like ‘rails foo’,  
your app will have this:

config.action\_controller.session = {  
:session\_key =\> ‘foo\_session’,  
:secret =\> ‘someuniquehash’  
}

–  
Rick O.  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)

---

<div class="post-metadata">

**Author:** ![klancaster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f1d935/32.png) [@klancaster](https://www.ruby-forum.com/u/klancaster)\
**Post date:** [March 1, 2007, 8:51pm UTC](https://www.ruby-forum.com/t/cookie-based-session-management-problems/87318/3 "2007-03-01T20:51:18Z")

</div>

Rick O. wrote:

> \<% %\> is used for erb. However, since config files use ruby, you’ll  
> have to use #{} for variables.
> 
> The reason Ryan’s sample has that is because he’s taking code from the  
> rails app generator. Once generated with a command like ‘rails foo’,  
> your app will have this:
> 
> config.action\_controller.session = {  
> :session\_key =\> ‘foo\_session’,  
> :secret =\> ‘someuniquehash’  
> }

That makes sense. Not knowing exactly how the entry was processed, I was  
unsure if somehow this was being processed by erb. I’ll post something  
back to Ryan to make sure this is clear.

Thanks

---

<div class="post-metadata">

**Author:** ![klancaster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f1d935/32.png) [@klancaster](https://www.ruby-forum.com/u/klancaster)\
**Post date:** [September 25, 2007, 11:09pm UTC](https://www.ruby-forum.com/t/cookie-based-session-management-problems/87318/4 "2007-09-25T23:09:12Z")

</div>

On 3/1/07, Russell N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> with single quotes? I’m presuming this will get evaluated somewhere else?  
> I’m a bit fuzzy on this and would totally appreciate any clarification.
> 
> RSL

Only if you have an app name variable in scope. Again, that is for  
the _generator_ only. For your rails app you can do something like  
this:

config.action\_controller.session = {  
:session\_key =\> ‘\_foo\_session’,  
:secret =\> ‘whatever’  
}

If you’re cryptographically challenged, you can use script/console to  
generate something for you:

> > CGI::Session.generate\_unique\_id(‘something’)

Naturally, any string will do.

–  
Rick O.  
[http://weblog.techno-weenie.net](http://weblog.techno-weenie.net)  
[http://mephistoblog.com](http://mephistoblog.com)

---

<div class="post-metadata">

**Author:** ![klancaster](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/f1d935/32.png) [@klancaster](https://www.ruby-forum.com/u/klancaster)\
**Post date:** [March 1, 2007, 9:09pm UTC](https://www.ruby-forum.com/t/cookie-based-session-management-problems/87318/5 "2007-03-01T21:09:35Z")

</div>

Heh. I put this in my new project too. I thought it looked strange  
having  
erb in the environment.rb file but when I used “#{}” [note the double  
quotes] I ran into a heap of trouble. So, if I now understand correctly,  
we  
should just having something like

config.action\_controller.session = {  
:session\_key =\> ‘\_#{app\_name}\_session’,  
:secret =\> ‘CGI::Session.generate\_unique\_id(#{app\_name})’  
}

with single quotes? I’m presuming this will get evaluated somewhere  
else?  
I’m a bit fuzzy on this and would totally appreciate any clarification.

RSL