# How to enforce ActiveRecord session store with Rails 2.0.2?

**URL:** <https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990>\
**Category:** Rails\
**Created:** [March 14, 2008, 9:59pm UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990 "2008-03-14T21:59:13Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [March 14, 2008, 9:59pm UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990/1 "2008-03-14T21:59:13Z")

</div>

All,

Rails 2.0.2  
SQL Server 2000 database  
SQL Server AR adapter 1.0 using ODBC

Apparently the new default session store is cookie based. I was using  
the ActiveRecord based session store and would like to continue to do  
so.

It appears that session data is not being written to my sessions table  
as used to be the case under 1.2.6.

My environment.rb file has the following:

Rails::Initializer.run do |config|  
…  
config.action\_controller.session\_store = :active\_record\_store  
…  
end

Is this directive no longer sufficient for forcing the session store to  
be a DB table named “sessions”? If that is the case, what is the  
correct way to specify the AR session store?

Thanks,  
Wes

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [March 14, 2008, 11:35pm UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990/2 "2008-03-14T23:35:14Z")

</div>

# Use the database for sessions instead of the cookie-based default,

# which shouldn’t be used to store highly confidential information

# (create the session table with ‘rake db:sessions:create’)

config.action\_controller.session\_store = :active\_record\_store

Have uncommented this line in your config/environment.rb file?

On Mar 14, 4:59 pm, Wes G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [March 14, 2008, 11:49pm UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990/3 "2008-03-14T23:49:20Z")

</div>

I just created a simple test application and set it up to use the  
database for session storage.

Step 1: config/environment.rb

# Use the database for sessions instead of the cookie-based default,

# which shouldn’t be used to store highly confidential information

# (create the session table with ‘rake db:sessions:create’)

config.action\_controller.session\_store = :active\_record\_store

Step 2: controllers/application.rb

# See ActionController::RequestForgeryProtection for details

# Uncomment the :secret if you’re not using the cookie session store

protect\_from\_forgery :secret =\> ‘5c0cf093b4866f589b91a08c048f7bfa’

This worked just fine in my test app.

On Mar 14, 4:59 pm, Wes G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [March 15, 2008, 3:06pm UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990/4 "2008-03-15T15:06:19Z")

</div>

Yes.

On Mar 15, 2:51 am, Wes G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [March 15, 2008, 7:51am UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990/5 "2008-03-15T07:51:27Z")

</div>

> Step 2: controllers/application.rb
> 
> # See ActionController::RequestForgeryProtection for details
> 
> # Uncomment the :secret if you’re not using the cookie session store
> 
> protect\_from\_forgery :secret =\> ‘5c0cf093b4866f589b91a08c048f7bfa’
> 
> This worked just fine in my test app.

Is the protect\_from\_forgery setting necessary?

Wes

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [March 16, 2008, 9:01am UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990/6 "2008-03-16T09:01:46Z")

</div>

Robert W. wrote:

> I just created a simple test application and set it up to use the  
> database for session storage.
> 
> Step 1: config/environment.rb
> 
> # Use the database for sessions instead of the cookie-based default,
> 
> # which shouldn’t be used to store highly confidential information
> 
> # (create the session table with ‘rake db:sessions:create’)
> 
> config.action\_controller.session\_store = :active\_record\_store
> 
> Step 2: controllers/application.rb
> 
> # See ActionController::RequestForgeryProtection for details
> 
> # Uncomment the :secret if you’re not using the cookie session store
> 
> protect\_from\_forgery :secret =\> ‘5c0cf093b4866f589b91a08c048f7bfa’
> 
> This worked just fine in my test app.

Which database server are you on?

Thanks,  
Wes

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [August 4, 2008, 9:38pm UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990/7 "2008-08-04T21:38:49Z")

</div>

Wes G. wrote:

> OK, so if I just copy and paste that line into my application.rb, I get  
> the exception:
> 
> ActionController::InvalidAuthenticityToken
> 
> Obviously, this token needs to be generated somehow locally by me - can  
> you point me at any documentation that explains how to do that?
> 
> Thanks,  
> Wes

eventho this is kinda old, i’d like to point out that maybe you should  
clear your cookie, reload the page and try again. i think it should  
create a new cookie with a correct token to associate with the session  
on the database.

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [March 15, 2008, 7:42pm UTC](https://www.ruby-forum.com/t/how-to-enforce-activerecord-session-store-with-rails-2-0-2/131990/8 "2008-03-15T19:42:23Z")

</div>

OK, so if I just copy and paste that line into my application.rb, I get  
the exception:

ActionController::InvalidAuthenticityToken

Obviously, this token needs to be generated somehow locally by me - can  
you point me at any documentation that explains how to do that?

Thanks,  
Wes