# How conditionally allow Session :off

**URL:** <https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428>\
**Category:** Rails\
**Created:** [May 22, 2008, 9:51pm UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428 "2008-05-22T21:51:33Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 22, 2008, 9:51pm UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/1 "2008-05-22T21:51:33Z")

</div>

I need to enable/disable sessions based on the incoming IP address.  
Any request coming from the IP that Rails is running from needs to  
have session :off, other IPs can create a session.

Right now I’m just using a hard coded address of the system Rails is  
running on–I’ll work out acquiring that dynamically as the next step.

Neither of these worked for me, and actually that makes sense now, so  
what would be the way to do it?

* * *

class ApplicationController \< ActionController::Base

if request.remote\_ip == ‘x.x.x.x’ # === request not available here  
session :off  
end

* * *

class ApplicationController \< ActionController::Base

before\_filter :check\_request\_source

def check\_request\_source  
if request.remote\_ip == ‘206.82.195.150’  
session :off # === session not available here  
end  
end

– gw

---

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 22, 2008, 10:03pm UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/2 "2008-05-22T22:03:18Z")

</div>

> Neither of these worked for me, and actually that makes sense now, so  
> what would be the way to do it?

Assuming the :only, :except and :session\_secure options are not  
enough, you can also do

session :off, :if =\> Proc.new { |req| … }

req is the request object ( so req.parameters is the parameters hash ,  
and i would imagine that req.remote\_ip would be there too.

Fred

---

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 22, 2008, 10:55pm UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/3 "2008-05-22T22:55:06Z")

</div>

On May 22, 2008, at 1:02 PM, Frederick C. wrote:

> > Neither of these worked for me, and actually that makes sense now, so  
> > what would be the way to do it?
> 
> Assuming the :only, :except and :session\_secure options are not  
> enough, you can also do
> 
> session :off, :if =\> Proc.new { |req| … }
> 
> req is the request object ( so req.parameters is the parameters hash ,  
> and i would imagine that req.remote\_ip would be there too.

Hmm. Looked promising, but these both cause 503 errors, so I figure I  
don’t have some syntax twist correct.

session :off, :if =\> Proc.new { |req| req.remote\_ip == ‘x.x.x.x’ }  
session :off, :if =\> Proc.new { |req| req.parameters[:remote\_ip] ==  
‘x.x.x.x’ }

– gw

---

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 22, 2008, 11:40pm UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/4 "2008-05-22T23:40:21Z")

</div>

Greg W. wrote:

> On May 22, 2008, at 1:02 PM, Frederick C. wrote:
> 
> > > Neither of these worked for me, and actually that makes sense now, so  
> > > what would be the way to do it?
> > 
> > Assuming the :only, :except and :session\_secure options are not  
> > enough, you can also do
> > 
> > session :off, :if =\> Proc.new { |req| … }
> > 
> > req is the request object ( so req.parameters is the parameters hash ,  
> > and i would imagine that req.remote\_ip would be there too.
> 
> Hmm. Looked promising, but these both cause 503 errors, so I figure I  
> don’t have some syntax twist correct.
> 
> session :off, :if =\> Proc.new { |req| req.remote\_ip == ‘x.x.x.x’ }  
> session :off, :if =\> Proc.new { |req| req.parameters[:remote\_ip] ==  
> ‘x.x.x.x’ }
> 
> – gw

This seems to work great for me:

session :off, :if =\> Proc.new { |req| req.remote\_ip == ‘127.0.0.1’ }

Check your log to see what the error is.

---

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 23, 2008, 9:19am UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/5 "2008-05-23T09:19:02Z")

</div>

> On 22 May 2008, at 21:54, Greg W. wrote:

> > > session :off, :if =\> Proc.new { |req| … }

> > Hmm. Looked promising, but these both cause 503 errors, so I figure I  
> > don’t have some syntax twist correct.
> > 
> > session :off, :if =\> Proc.new { |req| req.remote\_ip == ‘x.x.x.x’ }  
> > session :off, :if =\> Proc.new { |req| req.parameters[:remote\_ip] ==  
> > ‘x.x.x.x’ }
> 
> The first looks about right to me and works on a rails 2.0.2 app. What  
> the actual ruby error ?

It does work in local dev, but not in production. No errors or  
messages of any kind logged to either production.log nor the mongrel.

This was actually an attempt at a stop gap anyway. I probably just  
need to focus on getting to the root problem: excesssive empty  
session being generated by something pinging the home page of the  
application. I’ve removed/disabled all sources I can think of (load  
balancer monitors, nagios, monit, etc). The last thing I can think of  
is that mongrel itself is generating pings. As a band-aid, I was  
hoping to eliminate the session by IP filtering for now, but that  
appears to interfere with something. It’s an app I’ve inherited,  
written by folks new to Rails themselves, and has some stuff I  
haven’t yet fully figured out.

Anyway… original question answered. Thanks.

– gw

---

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 22, 2008, 11:26pm UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/6 "2008-05-22T23:26:14Z")

</div>

On 22 May 2008, at 21:54, Greg W. wrote:

> > session :off, :if =\> Proc.new { |req| … }  
> > ‘x.x.x.x’ }  
> > The first looks about right to me and works on a rails 2.0.2 app. What  
> > the actual ruby error ?

Fred

---

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 27, 2008, 3:25am UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/7 "2008-05-27T03:25:54Z")

</div>

Greg W. wrote:

> There is no error message in either production.log or in mongrel.log  
> I’m hoping someone has some debugging ideas.

I managed to force an error, but essentially all I am getting is that  
some code further in the page which uses session\_id gripes that it is  
not available because there is no sesion object. So, it’s like the if  
statement is turning sessions off for all requests, not just the  
filtered ones.

Why this would be different under mod\_rails vs mongrel, I juat can’t  
even guess.

– gw

---

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 27, 2008, 2:47am UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/8 "2008-05-27T02:47:50Z")

</div>

I need to resurrect this one.

I had switched to mod\_rails, and was able to use this

session :off, :if=\>Proc.new {|req| req.remote\_ip == ‘x.x.x.x’}

to do the filtering I said I needed in my original post.

However, mod\_rails is breaking other pieces of my application, and I  
need to go back to a mongrel\_cluster.

Another however… that session statement is causing the app to crash  
when run under mongrel – but only when run in production. Seems to  
work OK in development.

There is no error message in either production.log or in mongrel.log

I’m hoping someone has some debugging ideas.

– gw

---

<div class="post-metadata">

**Author:** ![S-gw](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/ed655f/32.png) [@S-gw](https://www.ruby-forum.com/u/S-gw)\
**Post date:** [May 28, 2008, 2:17am UTC](https://www.ruby-forum.com/t/how-conditionally-allow-session-off/138428/9 "2008-05-28T02:17:53Z")

</div>

(didn’t see this come back to the list)

I need to resurrect this one.

I had switched to mod\_rails, and was able to use this

session :off, :if=\>Proc.new {|req| req.remote\_ip == ‘x.x.x.x’}

to do the filtering I said I needed in my original post.

However, mod\_rails is breaking other pieces of my application, and I  
need to go back to a mongrel\_cluster.

Another however… that session statement is causing the app to crash  
when run under mongrel – but only when run in production. Seems to  
work OK in development.

There is no error message in either production.log or in mongrel.log

I’m hoping someone has some debugging ideas.

– gw