# Edge: Session Cookie Fix Causing Issues for Legacy App **URL:** \ **Category:** Rails\ **Created:** [March 13, 2007, 7:07pm UTC](https://www.ruby-forum.com/t/edge-session-cookie-fix-causing-issues-for-legacy-app/88714 "2007-03-13T19:07:15Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![cwd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/da6949/32.png) [@cwd](https://www.ruby-forum.com/u/cwd)\ **Post date:** [March 13, 2007, 7:07pm UTC](https://www.ruby-forum.com/t/edge-session-cookie-fix-causing-issues-for-legacy-app/88714/1 "2007-03-13T19:07:15Z")
I love the idea of the cookie fix for session storage. But… I’ve gone round and round to get edge working with a legacy app and wonder if anyone has any pointers. Here’s what’s happening. I fresh-installed: rails foo cd foo rake rails:freeze:edge rake rails:update – add secret to environment.rb – All good, passing tests, no problems with session cookies. Then I cp -r my application tree over, preserving environment.rb. After that copy, I get: ArgumentError (`name’ required): /vendor/rails/actionpack/lib/action\_controller/cgi\_ext/cookie\_performance\_fix.rb:44:in `initialize’ /vendor/rails/actionpack/lib/action\_controller/session/cookie\_store.rb:129:in `new’ /vendor/rails/actionpack/lib/action\_controller/session/cookie\_store.rb:129:in `write\_cookie’ /vendor/rails/actionpack/lib/action\_controller/session/cookie\_store.rb:87:in `close' /opt/local/lib/ruby/1.8/cgi/session.rb:324:in `close’ /vendor/rails/actionpack/lib/action\_controller/base.rb:1209:in `close\_session’ I’ve verified that the cookie name is coming in as empty and the ArgumentError is being raised for a reason. I just don’t see why that would be. Does anyone have any thoughts about this? Here’s more about the environment: About your application’s environment Ruby version 1.8.5 (i686-darwin8.8.1) RubyGems version 0.9.1 Rails version 1.2.0 Active Record version 1.14.4 Action Pack version 1.12.5 Action Web Service version 1.1.6 Action Mailer version 1.2.5 Active Support version 1.3.1 Edge Rails revision 6414 Application root /Users/sxross/rails/amu\_edge Environment development Database adapter mysql Database schema version 0 Plugins: ## exception\_notification file\_column haml \ View this message in context: [http://www.nabble.com/Edge%3A-Session-Cookie-Fix-Causing-Issues-for-Legacy-App-tf3397581.html#a9460095](http://www.nabble.com/Edge%3A-Session-Cookie-Fix-Causing-Issues-for-Legacy-App-tf3397581.html#a9460095) Sent from the RubyOnRails Users mailing list archive at [Nabble.com](http://Nabble.com). ---
**Author:** ![cwd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/da6949/32.png) [@cwd](https://www.ruby-forum.com/u/cwd)\ **Post date:** [March 13, 2007, 9:46pm UTC](https://www.ruby-forum.com/t/edge-session-cookie-fix-causing-issues-for-legacy-app/88714/2 "2007-03-13T21:46:48Z")
On 3/13/07, s.ross [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > I love the idea of the cookie fix for session storage. But… I’ve gone round > and round to get edge working with a legacy app and wonder if anyone has any > pointers. Here’s what’s happening. I fresh-installed: You need to provide :session\_key and :secret session options in environment.rb. It’s generated for you in new apps. config.action\_controller.session = { :session\_key =\> ‘\_myapp\_session’, :secret =\> ‘ssh! be quiet’ } Note that it’s moving from application.rb to the environment. I added an explicit ArgumentError rather than letting it fall through to an empty cookie name. [http://dev.rubyonrails.org/changeset/6415](http://dev.rubyonrails.org/changeset/6415) jeremy ---
**Author:** ![cwd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/da6949/32.png) [@cwd](https://www.ruby-forum.com/u/cwd)\ **Post date:** [March 13, 2007, 9:54pm UTC](https://www.ruby-forum.com/t/edge-session-cookie-fix-causing-issues-for-legacy-app/88714/3 "2007-03-13T21:54:48Z")
Thanks so much. Cookie-based sessions should be an amazing help. steve Jeremy K. wrote: > environment.rb. It’s generated for you in new apps. > > > – View this message in context: [http://www.nabble.com/Edge%3A-Session-Cookie-Fix-Causing-Issues-for-Legacy-App-tf3397581.html#a9463144](http://www.nabble.com/Edge%3A-Session-Cookie-Fix-Causing-Issues-for-Legacy-App-tf3397581.html#a9463144) Sent from the RubyOnRails Users mailing list archive at [Nabble.com](http://Nabble.com). ---
**Author:** ![cwd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/da6949/32.png) [@cwd](https://www.ruby-forum.com/u/cwd)\ **Post date:** [March 16, 2007, 2:02am UTC](https://www.ruby-forum.com/t/edge-session-cookie-fix-causing-issues-for-legacy-app/88714/4 "2007-03-16T02:02:07Z")
On 3/15/07, s.ross [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Here’s a follow-up question. Are session\_id values guaranteed to > remain the same between calls? I know you aren’t relying on the > session\_id to identify the information anymore. The session cookie now contains data rather than an id. > I only ask because I’ve been looking at Simple Captcha, which uses > the session\_id as part of the hash that identifies the captcha answer > in pstore. Oddly, the session\_id works perfectly with this when using > AR session store, but not with the new cookie-based session store. You can store an id in the session data instead. Rick O.'s CSRF-prevention plugin takes this approach. jeremy ---
**Author:** ![cwd](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/da6949/32.png) [@cwd](https://www.ruby-forum.com/u/cwd)\ **Post date:** [March 16, 2007, 1:51am UTC](https://www.ruby-forum.com/t/edge-session-cookie-fix-causing-issues-for-legacy-app/88714/5 "2007-03-16T01:51:07Z")
Here’s a follow-up question. Are session\_id values guaranteed to remain the same between calls? I know you aren’t relying on the session\_id to identify the information anymore. I only ask because I’ve been looking at Simple Captcha, which uses the session\_id as part of the hash that identifies the captcha answer in pstore. Oddly, the session\_id works perfectly with this when using AR session store, but not with the new cookie-based session store. Thoughts? Thx