# Create session only for logged-in **URL:** \ **Category:** Rails\ **Created:** [June 24, 2006, 1:00am UTC](https://www.ruby-forum.com/t/create-session-only-for-logged-in/64306 "2006-06-24T01:00:33Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![carmen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a9adbd/32.png) [@carmen](https://www.ruby-forum.com/u/carmen)\ **Post date:** [June 24, 2006, 1:00am UTC](https://www.ruby-forum.com/t/create-session-only-for-logged-in/64306/1 "2006-06-24T01:00:33Z")
i was wondering how a blog db has grown by about 15 mb in a week or two. it turns out its the sessions table… so ive tried this: class ApplicationController… session :off end class AccountController session :only, :login end and now, its impossible to login, and nothing ever appears in the session table. is this the right approach? i dont want to weed out the sessions with cron, i just want them to never be created unless its necessary… preferably without needing to go around and add a :only or :except for every action that might want to access session data… carmen ---
**Author:** ![carmen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a9adbd/32.png) [@carmen](https://www.ruby-forum.com/u/carmen)\ **Post date:** [June 24, 2006, 1:28am UTC](https://www.ruby-forum.com/t/create-session-only-for-logged-in/64306/2 "2006-06-24T01:28:00Z")
Couldn’t you just run a job every X time to remove old sessions (sessions that have not been accesed for an Y amount of time) ?? ---
**Author:** ![carmen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a9adbd/32.png) [@carmen](https://www.ruby-forum.com/u/carmen)\ **Post date:** [June 24, 2006, 1:40am UTC](https://www.ruby-forum.com/t/create-session-only-for-logged-in/64306/3 "2006-06-24T01:40:30Z")
On Sat Jun 24, 2006 at 01:32:03AM +0200, Matias S. wrote: > Couldn’t you just run a job every X time to remove old sessions (sessions > that have not been accesed for an Y amount of time) ?? yes, i could, and probably will weed them out once a month or something. the point being, id like the session to be accessible if it exists, anywhere it normally is. but only ever create sessions if the Account#Login method or something it triggers successfully completes, so the DB doesnt bloat in the first place…nip the problem at the bud 🙂 i dont really see doing a source code audit, then manually adding session :off, :exec =\> [] and continually pruning it as realistic in a huge app… ---
**Author:** ![carmen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a9adbd/32.png) [@carmen](https://www.ruby-forum.com/u/carmen)\ **Post date:** [June 24, 2006, 2:32am UTC](https://www.ruby-forum.com/t/create-session-only-for-logged-in/64306/4 "2006-06-24T02:32:47Z")
On 6/23/06, carmen [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > On Sat Jun 24, 2006 at 01:32:03AM +0200, Matias S. wrote: > > > Couldn’t you just run a job every X time to remove old sessions (sessions > > that have not been accesed for an Y amount of time) ?? > > yes, i could, and probably will weed them out once a month or something. the point being, id like the session to be accessible if it exists, anywhere it normally is. but only ever create sessions if the Account#Login method or something it triggers successfully completes, so the DB doesnt bloat in the first place…nip the problem at the bud 🙂 > > i dont really see doing a source code audit, then manually adding session :off, :exec =\> [] and continually pruning it as realistic in a huge app… Disabling sessions could cause all sorts of strange things to happen in a rails app. It’s really really not worth the effort. Setup a cron job to expire the sessions and move on. ---
**Author:** ![carmen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a9adbd/32.png) [@carmen](https://www.ruby-forum.com/u/carmen)\ **Post date:** [June 24, 2006, 3:33pm UTC](https://www.ruby-forum.com/t/create-session-only-for-logged-in/64306/5 "2006-06-24T15:33:12Z")
Be aware also, that some things like “flash” and many other things in rails are dependent on sessions, even for the “anonymous” users… ---
**Author:** ![carmen](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a9adbd/32.png) [@carmen](https://www.ruby-forum.com/u/carmen)\ **Post date:** [June 24, 2006, 11:50am UTC](https://www.ruby-forum.com/t/create-session-only-for-logged-in/64306/6 "2006-06-24T11:50:56Z")
> in a rails app. It’s really really not worth the effort. Setup a I wouldn’t say it’s not worth it - at least on a high traffic site. otherwise you are right You should not only enable sessions for the login page but also for all pages that access the session. I have seen you only enabled it for the login action. you also need it for all actions that rely on / check for a logged in user. - peter snacktime schrieb: