# Issues with ajax requests and user session **URL:** \ **Category:** Rails\ **Created:** [August 13, 2009, 3:31am UTC](https://www.ruby-forum.com/t/issues-with-ajax-requests-and-user-session/173669 "2009-08-13T03:31:25Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![jsoho](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8baadc/32.png) [@jsoho](https://www.ruby-forum.com/u/jsoho)\ **Post date:** [August 13, 2009, 3:31am UTC](https://www.ruby-forum.com/t/issues-with-ajax-requests-and-user-session/173669/1 "2009-08-13T03:31:25Z")
I’m using an exception notification plugin which sends me an email whenever an exception is raised on the rails server. Regularly I’m getting exception reports due to raising a PermissionDenied exception when a user has no access or because rails complains about an invalid authenticity token. I can never reproduce these. And in 99% of the cases it works fine for our users, but there’s a 1% for whom it apparently fails. These exceptions are always due to an action triggered by an ajax request. The content of the exception report is always something like below. The thing I find odd is that the HTTP\_COOKIE indicates the user is logged in, but the session section reports a session\_id of nil. I.e., the code will see the user as logged out, and raise an access denied exception. In my log I can see that subsequent (non-Ajax) requests from the same user do work fine. I also notice that all exception reports are always from MSIE6.0 and MSIE7.0 clients. I’m using jQuery. I was wondering if anyone else has seen issues like this. Is there a known cause and/or workaround / solution? Cheers, Jimmy * * * ## Request: - URL : [http://example.com/ajaxaction](http://example.com/ajaxaction) - IP address: 165.86.81.25 - Parameters: {“format”=\>“json”, “action”=\>“ajaxaction”, “\_method”=\>“put”, “authenticity\_token”=\>“/y/ G2RkIl8kQjgkc934aui8iEvJ1HeOfCY6EnB3/VQs=”, “controller”=\>“posts”, “invitation\_code”=\>“4ba96ffdcb92dc054bbf5fb803099645cc1ce10d”} - Rails root: /var/www/production.example.com/releases/ 20090812034504 * * * ## Session: - session id: nil - data: nil * * * ## Environment: - CONTENT\_LENGTH : 83 - CONTENT\_TYPE : application/x-www- form-urlencoded - DOCUMENT\_ROOT : /var/www/ [production.example.com/current/public](http://production.example.com/current/public) - HTTP\_ACCEPT : application/json, text/javascript, _/_, text/javascript - HTTP\_ACCEPT\_LANGUAGE : en-au - HTTP\_CONNECTION : Keep-Alive - HTTP\_CONTENT\_TYPE : application/x-www- form-urlencoded - HTTP\_COOKIE : \_\_utma=136239534.4438442336996744000.1340901452.12403901452.1250110149.2; \_\_utmb=133279534.11.30.1230110149; \_\_utmz=136279534.1240901452.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd= (none); \_example\_session=BAh7CjoPc2Vzc2lvbl9pZCIlMWQ3ZWIwYTJlYzRkNGI2OTk0MTVjYWE3NTRhZTJlNzA6EF9jc3JmX3Rva2VuIjEveS9HMlJrS3w4a1FqZ2tjOGk2YXVpOGlFdkoxSGVPZkNZNkVuQjMvVlFzPToMdXNlcl9pZGkCw2o6CHNzaSINLGxpYnJhcnkiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFz3Ehhc2h7AAY6CkB1c2VkewA %3D–9a490353a0b021dead9cbd438fd97997eb22c70a; \_\_utmc=136579534; \_\_qca=1242135797-11579318-30372251; \_\_qcb=496730851; \_\_gads=ID=4b3d13fa4267a99d:T=1250110172:S=ALNI\_MZjarEIGP8SctjtUWhuKtWFvl7Edg; auth\_token=; \_\_unam=7659673-12310665fd4-664da270-1 - HTTP\_HOST : [example.com](http://example.com) - HTTP\_PRAGMA : no-cache - HTTP\_REFERER : [http://example.com/](http://example.com/) - HTTP\_USER\_AGENT : Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1) - HTTP\_VIA : 1.0 GWD-BK7-PXY01, 1.1 GWD-BK7-PXY03 - HTTP\_X\_NOVINET : v1.2 - HTTP\_X\_REQUESTED\_WITH : XMLHttpRequest - PATH\_INFO : /ajaxaction - QUERY\_STRING : - REMOTE\_ADDR : 165.86.81.25 - REMOTE\_PORT : 41604 - REQUEST\_METHOD : PUT - REQUEST\_URI : /ajaxaction - SCRIPT\_NAME : - SERVER\_ADDR : 100.22.88.200 - SERVER\_ADMIN : removed\_email\_address@domain.invalid - SERVER\_NAME : [example.com](http://example.com) - SERVER\_PORT : 80 - SERVER\_PROTOCOL : HTTP/1.1 - SERVER\_SOFTWARE : Apache/2.2.8 (Ubuntu) mod\_ssl/2.2.8 OpenSSL/0.9.8g Phusion\_Passenger/2.2.3 - \_ : \_ - action\_controller.request.path\_parameters : formatjsonactionaccept\_postscontroller4ba96ffdcb92dc054bbf5fb803099645cc1ce10d - action\_controller.request.query\_parameters : - action\_controller.request.request\_parameters: authenticity\_token/y/ G2RkIl8kQjgkc8i6aui8iEvJ1HeOfCY6EnB3/VQs=\_methodput - action\_controller.rescue.request : #ActionController::Request:0x7f1e3e134f80 - action\_controller.rescue.response : #ActionController::Response:0x7f1e3e130778 - rack.errors : #IO:0x7f1e47c9cea0 - rack.input : #Rack::RewindableInput:0x7f1e3e13ee40 - rack.methodoverride.original\_method : POST - rack.multiprocess : true - rack.multithread : false - rack.request.cookie\_hash : \_\_utma136279534.4458442336996744000.1240901452.1240901452.1250110149.2\_\_utmb136279534.11.10.1250110149\_\_utmc136279534\_\_utmz136279534.1240901452.1.1.utmcsr= (direct)|utmccn=(direct)|utmcmd=(none) \_example\_sessionBAh7Czc2lvbl9pZCIlMWQ3ZWIwYTJlYzRkNGI2OTk0MTVjYWE3NTRhZTJlNzA6EF9jc3JmX3Rva2VuIjEveS9HMlJrSWw4a1FqZ2tjOGk2YXVpOGlFdkoxSGVPZkNZNkVuQjMvVNlcl9pZGkCw2o6CHNzaSINLGxpYnJhcnkiCmZsYXN6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA=–9a490353a0b021dead28fd97997eb22c70aauth\_token\_\_qca1245797-19318-302251\_\_qcb4740851\_\_gadsID=4b3d18f7a99d:T=1250110172:S=ALNI\_MZjarEIGPtUWhuKtWFvl7Edg\_\_unam7639673-123665fd4-665da270-1 - rack.request.cookie\_string : \_\_utma=136279534.4458442336996744000.1240901452.1240901452.1250110149.2; \_\_utmb=136279534.11.10.1250110149; \_\_utmz=136279534.1240901452.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd= (none); \_example\_session=BAh7CjoPc2Vzc2lvbl9pZCIlMWQ3ZWIwYTJ2OTk0MTVjYWE3NTRhZTJlNzA6EF9jc3JmX3Rva2VuIjEveS9HMlJrSWw4a1FqZ2tjOGk2YXVpOGlFdkoxSGVPZkNZNkVuQjMvVlFzPToMdXNlcl9pZGkCw2o6CHNzaSINLGxpYnJhcnkiCmZsYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2VkewA %3D–9a490353a0b02fd97997eb22c70a; \_\_utmc=13634; \_\_qca=12421797-11318-372251; \_\_qcb; \_\_gads=ID=4b3d18fa4267a99d:T=1250110172:S=ALNI\_MZjarEhuKtWFvl7Edg; auth\_token=; \_\_unam=7639673-12310665fd4-665da270-1 - rack.request.form\_hash : authenticity\_token/y/ G2RkIl8kQjgkc8J1HeOfCY6EnB3/VQs=\_methodput - rack.request.form\_input : #Rack::RewindableInput:0x7f1e3e13ee40 - rack.request.form\_vars : \_method=put&authenticity\_token=%2Fy%2FG2RkIl8kQjiEvJ1HeOfCY6EnB3%2FVQs %3D - rack.request.query\_hash : - rack.request.query\_string : - rack.run\_once : false - rack.session : session\_id1d7eb0a2ec4aa754ae2e70\_csrf\_token/y/ G2RkIl8ui8iEvJ1HeOfCY6EnB3/VQs=user\_id21 - rack.session.options : path/ expire\_afterhttponlytruedomain.example.comid1d7eb0a2ec4d4b69a754ae2e70key\_session\_id - rack.url\_scheme : http - rack.version : 10 - Process: 20353 - Server : exampleproduction ---
**Author:** ![jsoho](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8baadc/32.png) [@jsoho](https://www.ruby-forum.com/u/jsoho)\ **Post date:** [August 13, 2009, 10:05am UTC](https://www.ruby-forum.com/t/issues-with-ajax-requests-and-user-session/173669/2 "2009-08-13T10:05:55Z")
On Aug 13, 2:30 am, Jimmy [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > request. do you have a concurrent request problem ? when you get two overlapping requests from a single user then changes by one of them to the session will ‘beat’ changes by the other one. Fred ---
**Author:** ![jsoho](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8baadc/32.png) [@jsoho](https://www.ruby-forum.com/u/jsoho)\ **Post date:** [August 13, 2009, 1:37pm UTC](https://www.ruby-forum.com/t/issues-with-ajax-requests-and-user-session/173669/3 "2009-08-13T13:37:16Z")
I’ve seen these in production - but I’ve never been able to run down the source. It’s always IE that’s causing them, though. I think there may be some PC antivirus or “accelerator” that’s trying to prefetch stuff but doing it wrong… –Matt J. ---
**Author:** ![jsoho](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/8baadc/32.png) [@jsoho](https://www.ruby-forum.com/u/jsoho)\ **Post date:** [August 14, 2009, 4:03am UTC](https://www.ruby-forum.com/t/issues-with-ajax-requests-and-user-session/173669/4 "2009-08-14T04:03:26Z")
This action is triggered by pressing a button which executes a piece of javascript… the setup is done in a jquery document ready block of code. It would highly surprise me if a prefetcher would trigger that button. As the action is triggered by a user action, I also don’t think this should give a concurrent request problem. (the app runs in passenger too, I was under the impression that within passenger you shouldn’t run into any concurrency issues anyways?) The source is indeed always an MSIE browser, which would suggest a browser issue. However, seeing that the browser does send a correct cookie with the session id in there, I wonder if for some reason the rails server can’t match the session… Jimmy