# Headache with sessions being shared **URL:** \ **Category:** Rails\ **Created:** [November 1, 2009, 8:09pm UTC](https://www.ruby-forum.com/t/headache-with-sessions-being-shared/178268 "2009-11-01T20:09:58Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![aftershock](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e7dd6/32.png) [@aftershock](https://www.ruby-forum.com/u/aftershock)\ **Post date:** [November 1, 2009, 8:09pm UTC](https://www.ruby-forum.com/t/headache-with-sessions-being-shared/178268/1 "2009-11-01T20:09:58Z")
I have a really horrendous problem with sessions. before\_filter :find\_cart\_from\_session private def find\_cart\_from\_session if session[:cart] # if there’s is a cart in the session begin @cart = Cart.find(session[:cart]) # return existing or new cart rescue ActiveRecord::RecordNotFound @cart = Cart.create @cart.save session[:cart] = @cart.id # add a new one end else @cart = Cart.create @cart.save session[:cart] = @cart.id # add a new one end @cart end This code works. I mean it will return the cart object but … 2 different computers add the same product to their cart whoever gets the product in first get both products. user 1 adds product 1 user 1 sees 1 product in their cart user 2 adds product 1 user 2 sees no products user 1 refreshes and now sees two product 1’s in their cart. user 2 adds product 2 user 2 should now have 1 x product 1 and 1 x product 2 But user 2 has 0 x product 1 and 1 x product 2 user 1 now adds product 2 to their cart user 2 refreshes and has 2 x product 2 Now at this point both user 1 and user 2 should have 1 of each prioduct in their cart. Controller action for this is def add\_to\_cart product = Product.find(params[:id]) @cart = find\_cart @cart.add\_product(product) redirect\_to\_category\_menu rescue ActiveRecord::RecordNotFound logger.error(“Attempt to access invalid product #{params[:id]}” ) redirect\_to\_category\_menu ‘Invalid product’ end I’m using database storage for the session. This is a total nightmare and I have just lost all my confidence in Rails even though this may be something wrong with the way I have set up the environment this surely should not be allowed to happen. Any ideas on what I have got wron or should be looking at? Thanks James ---
**Author:** ![aftershock](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e7dd6/32.png) [@aftershock](https://www.ruby-forum.com/u/aftershock)\ **Post date:** [November 1, 2009, 8:27pm UTC](https://www.ruby-forum.com/t/headache-with-sessions-being-shared/178268/2 "2009-11-01T20:27:17Z")
First thing I’d do is run in development mode and double check what sql statements are being sent to the database to find those sessions. I’ve been working only with cookie sessions, so naturally I’d suspect that. Then place a debugger statements here: def find\_cart\_from\_session debugger if session[:cart] # if there’s is a cart in the session and take a look at session[:cart]. Is it a blank string, what class is it, etc. On Nov 1, 1:09 pm, James W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![aftershock](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e7dd6/32.png) [@aftershock](https://www.ruby-forum.com/u/aftershock)\ **Post date:** [November 1, 2009, 10:56pm UTC](https://www.ruby-forum.com/t/headache-with-sessions-being-shared/178268/3 "2009-11-01T22:56:58Z")
JDevine - Thank you for the pointers. I’ve tracked down the problem. This app was upgraded from Rails 2.1.2 to 2.3.2 The session handling changed between these versions and the :secret was moved to the config/initializers/session\_store.rb This obviously does not exist so I have created one which leads me on to another question Is there any way of setting the :key dynamically? :key =\> some\_function def some\_function get\_the\_name\_of\_the\_app\_somehow? end This would enable me to keep the keys unique for each application deployment. James JDevine wrote: > First thing I’d do is run in development mode and double check what > sql statements are being sent to the database to find those sessions. > I’ve been working only with cookie sessions, so naturally I’d suspect > that. > > Then place a debugger statements here: > > def find\_cart\_from\_session > debugger > if session[:cart] # if there’s is a cart in the session > > and take a look at session[:cart]. Is it a blank string, what class is > it, etc. > > On Nov 1, 1:09�pm, James W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![aftershock](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e7dd6/32.png) [@aftershock](https://www.ruby-forum.com/u/aftershock)\ **Post date:** [November 2, 2009, 1:57am UTC](https://www.ruby-forum.com/t/headache-with-sessions-being-shared/178268/4 "2009-11-02T01:57:27Z")
That works for one site but with multiple sites each key should be unique so I need it to be set dynamically otherwise people visiting site one will have the same key for site 2, site 3 and so on… But I’m still struggling with the session issue so I’ll worry about the key later. JDevine wrote: > Honestly I don’t have experience with that, or even know exactly what > the key does, but I suspect that you would want the key to remain the > same for the life of the app, so you really don’t want to set it > dynamically. Otherwise, every time you make a change to the app your > sessions would all be invalid, which causes nasty errors that are hard > to decipher. Set the key by hand or via a generator or something when > you create the app then leave it alone. > > On Nov 1, 3:56�pm, James W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![aftershock](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e7dd6/32.png) [@aftershock](https://www.ruby-forum.com/u/aftershock)\ **Post date:** [November 2, 2009, 1:02am UTC](https://www.ruby-forum.com/t/headache-with-sessions-being-shared/178268/5 "2009-11-02T01:02:44Z")
Honestly I don’t have experience with that, or even know exactly what the key does, but I suspect that you would want the key to remain the same for the life of the app, so you really don’t want to set it dynamically. Otherwise, every time you make a change to the app your sessions would all be invalid, which causes nasty errors that are hard to decipher. Set the key by hand or via a generator or something when you create the app then leave it alone. On Nov 1, 3:56 pm, James W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![aftershock](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/8e7dd6/32.png) [@aftershock](https://www.ruby-forum.com/u/aftershock)\ **Post date:** [November 2, 2009, 4:38am UTC](https://www.ruby-forum.com/t/headache-with-sessions-being-shared/178268/6 "2009-11-02T04:38:12Z")
ActiveSupport::SecureRandom.hex(64) can generate session key 2009/11/2 James W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)