# How to use cookie based session?

**URL:** <https://www.ruby-forum.com/t/how-to-use-cookie-based-session/134479>\
**Category:** Deployment\
**Created:** [April 11, 2008, 8:17am UTC](https://www.ruby-forum.com/t/how-to-use-cookie-based-session/134479 "2008-04-11T08:17:03Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![zukjimote](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/df705f/32.png) [@zukjimote](https://www.ruby-forum.com/u/zukjimote)\
**Post date:** [April 11, 2008, 8:17am UTC](https://www.ruby-forum.com/t/how-to-use-cookie-based-session/134479/1 "2008-04-11T08:17:03Z")

</div>

I just installed Rails 2.0.2.  
While moving an application made in Rails 1.2 to Rails 2.0.2, I got a  
problem of session.  
I was using the variable @session[].  
How should I change the old fashioned way to the new way, which is  
cookie based session? How can I implement session or cookies in Rails 2?  
I don’t want to keep using ActiveRecord based session.  
Please give me a concrete help.  
Links are also welcome.

---

<div class="post-metadata">

**Author:** ![zukjimote](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/df705f/32.png) [@zukjimote](https://www.ruby-forum.com/u/zukjimote)\
**Post date:** [April 11, 2008, 12:12pm UTC](https://www.ruby-forum.com/t/how-to-use-cookie-based-session/134479/2 "2008-04-11T12:12:16Z")

</div>

Cookie based session is the default.  
as to ‘@session’ it is deprecated, use just ‘session’ instead.

if you are upgrading an existing app to latest rails you will need to  
update all the config/\* files.  
since you probably have made some changes to it, I think the best way  
is to just create an  
empty rails application and then compare the files in it’s ‘config’  
dir with your app.

For example the section that deals with the session looks like that  
(config/environment.rb):

# Your secret key for verifying cookie session data integrity.

# If you change this key, all old sessions will become invalid!

# Make sure the secret is at least 30 characters and all random,

# no regular words or you’ll be exposed to dictionary attacks.

config.action\_controller.session = {  
:session\_key =\> ‘\_qwe\_session’,  
:secret =\>  
‘3e59eabb481dc16c654402f79db3898004a1f83c5bc556349eb0dcf8385b667f33b0e4434fe950dcd0c4418f25bae29f014b535e990cb7c970ba563fb6a07988’  
}

# Use the database for sessions instead of the cookie-based default,

# which shouldn’t be used to store highly confidential information

# (create the session table with ‘rake db:sessions:create’)

# config.action\_controller.session\_store = :active\_record\_store

As you can see ‘config.action\_controller.session\_store  
= :active\_record\_store’ is commented out, so the default ‘cookie’  
store is used.

Also note that rails now has a new directory config/initializers.  
every .rb file that you put there will be executed during  
initialization, so it is  
better to add files there then adding stuff to config/environment.rb  
itself.

On Apr 11, 9:17 am, Yohan Jo [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![zukjimote](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/z/df705f/32.png) [@zukjimote](https://www.ruby-forum.com/u/zukjimote)\
**Post date:** [July 14, 2008, 4:59am UTC](https://www.ruby-forum.com/t/how-to-use-cookie-based-session/134479/3 "2008-07-14T04:59:29Z")

</div>

Thanks.  
It works really fine.