# Cookie vs db session store behavior

**URL:** <https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310>\
**Category:** Rails\
**Created:** [June 24, 2008, 4:39pm UTC](https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310 "2008-06-24T16:39:52Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![blackflash](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/dfb087/32.png) [@blackflash](https://www.ruby-forum.com/u/blackflash)\
**Post date:** [June 24, 2008, 4:39pm UTC](https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310/1 "2008-06-24T16:39:52Z")

</div>

I’m wondering if this is normal way how rails handles sessions…

When I login (create a session on server), application sets cookie  
value in the HTTP header.

Key: Set-Cookie  
Value:  
\_my\_session\_id=BAe7CDoOcmV0dXJuX3RvMqIKsmxhc2hJQzonQWN0aW9uQ13udHJvbGxlcjo6%220ARmvhc2g6YkZsYXNoSGFzaHsABjoKQHVzZWR7ADoJdXNlcmkC3wM  
%253D–d806ac851b4e6ee4310dcf2abdcf57e3ea4c12cb; path=/ )

When I logout (delete a session), application gives me other value for  
the Set-Cookie header.

But, on every next login and logout application sets the SAME value  
for Set-Cookie header.

And, when I use db session based store, application always sets  
different values for Set-Cookie header, which is better behavior.

I think, when using cookie based session store, application should set  
different values for Set-Cookie header, maybe add some hashed  
timestamp to the Set-Cookie value in case to recognize by it if the  
session is some old, or it is the last one for.

Any suggestions?

---

<div class="post-metadata">

**Author:** ![blackflash](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/dfb087/32.png) [@blackflash](https://www.ruby-forum.com/u/blackflash)\
**Post date:** [June 24, 2008, 5:04pm UTC](https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310/2 "2008-06-24T17:04:32Z")

</div>

On 24 Jun 2008, at 15:39, blackflash wrote:

> BAe7CDoOcmV0dXJuX3RvMqIKsmxhc2hJQzonQWN0aW9uQ13udHJvbGxlcjo6  
> %220ARmvhc2g6YkZsYXNoSGFzaHsABjoKQHVzZWR7ADoJdXNlcmkC3wM  
> %253D–d806ac851b4e6ee4310dcf2abdcf57e3ea4c12cb; path=/ )
> 
> When I logout (delete a session), application gives me other value for  
> the Set-Cookie header.
> 
> But, on every next login and logout application sets the SAME value  
> for Set-Cookie header.

with the database store the cookie value is just some identifier used  
to look something up in a table. New session = new cookie value.  
With the cookie store, the cookie value is the contents of the  
session, so if the contents are the same the cookie will be the same.  
The cookie store does not try and guard against replay of an old  
session, you’ll have to do that yourself.

Fred

---

<div class="post-metadata">

**Author:** ![blackflash](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/dfb087/32.png) [@blackflash](https://www.ruby-forum.com/u/blackflash)\
**Post date:** [June 24, 2008, 5:15pm UTC](https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310/3 "2008-06-24T17:15:43Z")

</div>

Yes, that’s it! Thanks.

Are you familiar with any example on internet about creating ‘Set-  
Cookie’ and decoding ‘Cookie’ values from requests / responses?

---

<div class="post-metadata">

**Author:** ![blackflash](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/dfb087/32.png) [@blackflash](https://www.ruby-forum.com/u/blackflash)\
**Post date:** [June 24, 2008, 7:03pm UTC](https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310/4 "2008-06-24T19:03:41Z")

</div>

> You mean you want to decode the rails session cookie? it’s just base64  
> encoded marshal data (up until the --, the rest is the signature)
> 
> Fred

No, I’m just trying to find way and make guard against replay of an  
old session… so, probably I should play around with request and  
response objects to change the defaults for Set-Cookie value that  
rails app sets on the response object, and Cookie value that rails app  
is supposed to receive from the client.

Cheers!  
Dalibor

---

<div class="post-metadata">

**Author:** ![blackflash](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/dfb087/32.png) [@blackflash](https://www.ruby-forum.com/u/blackflash)\
**Post date:** [June 24, 2008, 6:49pm UTC](https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310/5 "2008-06-24T18:49:35Z")

</div>

On 24 Jun 2008, at 16:15, blackflash wrote:

> Yes, that’s it! Thanks.
> 
> Are you familiar with any example on internet about creating ‘Set-  
> Cookie’ and decoding ‘Cookie’ values from requests / responses?

You mean you want to decode the rails session cookie? it’s just base64  
encoded marshal data (up until the --, the rest is the signature)

Fred

---

<div class="post-metadata">

**Author:** ![blackflash](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/dfb087/32.png) [@blackflash](https://www.ruby-forum.com/u/blackflash)\
**Post date:** [June 24, 2008, 7:54pm UTC](https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310/6 "2008-06-24T19:54:04Z")

</div>

> Just store a timestamp in the session and have a before filter that  
> checks it ?

That’s it, madafaka! Thanks!

---

<div class="post-metadata">

**Author:** ![blackflash](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/dfb087/32.png) [@blackflash](https://www.ruby-forum.com/u/blackflash)\
**Post date:** [June 24, 2008, 7:13pm UTC](https://www.ruby-forum.com/t/cookie-vs-db-session-store-behavior/141310/7 "2008-06-24T19:13:03Z")

</div>

On 24 Jun 2008, at 18:03, blackflash wrote:

> rails app sets on the response object, and Cookie value that rails app  
> is supposed to receive from the client.

Just store a timestamp in the session and have a before filter that  
checks it ?