# Disable sessions for API

**URL:** <https://www.ruby-forum.com/t/disable-sessions-for-api/76455>\
**Category:** Rails\
**Created:** [November 19, 2006, 3:58am UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455 "2006-11-19T03:58:21Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 19, 2006, 3:58am UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/1 "2006-11-19T03:58:21Z")

</div>

So I just noticed that rails went on faithfully creating new sessions  
for each API request. I’d like to stop this behavior, but don’t quite  
know how.

I am using edge with REST routes (api.resources). Is there something I  
can pass from there to turn off sessions for these accessess?

I suspect it will take the form of:  
session :off, :if =\> something

Any ideas?

Cheers,  
Jake

---

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 19, 2006, 10:40am UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/2 "2006-11-19T10:40:21Z")

</div>

In your controller, put:

session :disabled =\> true

---

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 19, 2006, 6:42pm UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/3 "2006-11-19T18:42:58Z")

</div>

Bruno C. wrote:

> In your controller, put:
> 
> session :disabled =\> true

That would disable sessions for ALL requests to the controller. I only  
want to disable sessions for API communication.

With the RESTful stuff, the API and standard HTML rendering are all  
rolled up into the same controllers and actions, so something else needs  
to be done.

Jake

---

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 19, 2006, 10:16pm UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/4 "2006-11-19T22:16:22Z")

</div>

Bruno C. wrote:

> I think I found what you want. From the doc:  
> [http://api.rubyonrails.org/classes/ActionController/SessionManagement/ClassMethods.html#M000102](http://api.rubyonrails.org/classes/ActionController/SessionManagement/ClassMethods.html#M000102)
> 
> See the last example with :if and Proc.  
> params[:format] will give you the requested format, you can probably  
> play with it to disable session.

Yes, I mentioned this in my initial post. I don’t understand, however,  
what is passed into that Proc.

You’re saying I could do:  
:if Proc.new {|req| req.params[:format] }

What class is “req” ? I’d like to look it up to see what method I can  
use on it.

Jake

---

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 19, 2006, 8:05pm UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/5 "2006-11-19T20:05:10Z")

</div>

I think I found what you want. From the doc:  
[http://api.rubyonrails.org/classes/ActionController/SessionManagement/ClassMethods.html#M000102](http://api.rubyonrails.org/classes/ActionController/SessionManagement/ClassMethods.html#M000102)

See the last example with :if and Proc.  
params[:format] will give you the requested format, you can probably  
play with it to disable session.

---

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 20, 2006, 6:12pm UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/6 "2006-11-20T18:12:03Z")

</div>

Rohith R. wrote:

> Hey Jake,
> 
> I would assume that the proc just has to return true or false indicating  
> whether or not to create a new session.
> 
> so something along the lines of
> 
> session :off, :if =\> Proc.new {|r| r.parameters[:format] == :api}
> 
> or something along those lines.
> 
> HTH

That seems reasonable, but I’m still stuck on “r”. What class is it?  
Where is it created? How does one put :format into the parameters hash?  
Can this be done from routes.rb ?

Maybe this is incredibly simple, but it’s just not clear to me.

---

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 20, 2006, 2:46pm UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/7 "2006-11-20T14:46:05Z")

</div>

Hey Jake,

I would assume that the proc just has to return true or false indicating  
whether or not to create a new session.

so something along the lines of

session :off, :if =\> Proc.new {|r| r.parameters[:format] == :api}

or something along those lines.

HTH

---

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 20, 2006, 8:45pm UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/8 "2006-11-20T20:45:57Z")

</div>

On Nov 20, 2006, at 9:12 AM, Jake J. wrote:

> That seems reasonable, but I’m still stuck on “r”. What class is it?  
> Where is it created? How does one put :format into the parameters  
> hash?  
> Can this be done from routes.rb ?
> 
> Maybe this is incredibly simple, but it’s just not clear to me.

It’s the request object. One of these:  
[http://api.rubyonrails.org/classes/ActionController/](http://api.rubyonrails.org/classes/ActionController/)  
AbstractRequest.html

If you’re using the RESTful routes in edge rails, a request of posts/  
1.api will set :format to ‘api’ (as in the previous e-mail’s  
example). The route looks like this:

GET /posts/:id.:format/  
{:controller=\>“posts”, :action=\>“show”}

It all depends on how you want your API to be accessed. It’s up to you.

For more session info, see here:  
[irb Mix Tape — err.the\_blog](http://errtheblog.com/post/24)

–  
Chris W.

> **[err.the\_blog](http://errtheblog.com)**
>
> Err the Blog: Ruby and Rails from the front.

---

<div class="post-metadata">

**Author:** ![janovetz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/53a042/32.png) [@janovetz](https://www.ruby-forum.com/u/janovetz)\
**Post date:** [November 20, 2006, 9:20pm UTC](https://www.ruby-forum.com/t/disable-sessions-for-api/76455/9 "2006-11-20T21:20:32Z")

</div>

Chris W. wrote:

> On Nov 20, 2006, at 9:12 AM, Jake J. wrote:  
> If you’re using the RESTful routes in edge rails, a request of posts/  
> 1.api will set :format to ‘api’ (as in the previous e-mail’s  
> example). The route looks like this:
> 
> GET /posts/:id.:format/  
> {:controller=\>“posts”, :action=\>“show”}

Hm. Ok. Getting closer.

For the sake of posterity, I have my API routes setup to authenticate by  
a token:

map.with\_options :path\_prefix =\> “/api/:api\_token” do |api|  
api.resources :person  
api.resources :company  
…  
end

So my session disabling stuff is then:

session :off, :if =\> Proc.new {|req|  
!req.parameters[:api\_token].nil?}

Thanks for all the help, gents. I think things are working now.

Jake