# Lost session with file upload **URL:** \ **Category:** Rails\ **Created:** [August 31, 2007, 6:09am UTC](https://www.ruby-forum.com/t/lost-session-with-file-upload/113449 "2007-08-31T06:09:27Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Long](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e47774/32.png) [@Long](https://www.ruby-forum.com/u/Long)\ **Post date:** [August 31, 2007, 6:09am UTC](https://www.ruby-forum.com/t/lost-session-with-file-upload/113449/1 "2007-08-31T06:09:27Z")
I’ve search this group for reports of this problem but didn’t find anything useful. I am doing the following with plain vanilla Rails 1.1.6 running WEBrick. View: Upload photo Controller: def post\_photo session[:photo\_original\_filename] = params[:photo][:original\_filename] redirect\_to :controller =\> ‘home’, :action =\> ‘index’ end Problem: I login with a user account and have access to all member-only pages. Then I access the file upload view, select a local file and press the [Upload] button. I was supposed to be redirected to /home/index where session[:photo\_original\_filename] is displayed. However I was redirected to the Login page instead. This was because my authenticate user filter had failed when it shouldn’t. I figure the session may have changed so I recorded the session\_id before and after [Upload] button was pressed. They were indeed different. Next, I remove the enctype=“multipart/form-data” part from the form declaration. I perform the steps again and was redirected /home/index, as expected (with my current session remained in tact). So, I don’t know what the problem is and do hope someone could provide some insight. Much appreciated, – Long ---
**Author:** ![Long](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e47774/32.png) [@Long](https://www.ruby-forum.com/u/Long)\ **Post date:** [September 1, 2007, 12:39am UTC](https://www.ruby-forum.com/t/lost-session-with-file-upload/113449/2 "2007-09-01T00:39:48Z")
Well, I tried a few more things and found the culprit: I removed the above line and the file upload work as expected (well almost). It seems there is something quirky with enctype= and \_session\_id processing. Bug: params[:photo][:original\_filename] should be params[:photo].original\_filename Hope this will be useful to some for reference. Cheers, – Long ----- Original Message ----- From: “Long” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Friday, August 31, 2007 12:04 AM Subject: [Rails] Lost session with file upload > I login with a user account and have access to all member-only pages. Then I access the file upload view, select a local file and press the [Upload] button. I was supposed to be redirected to /home/index where session[:photo\_original\_filename] is displayed. > However I was redirected to the Login page instead. This was because my authenticate user filter > had > failed when it shouldn’t. > > I figure the session may have changed so I recorded the session\_id before and after [Upload] > button > was pressed. They were indeed different. > > Next, I remove the enctype=“multipart/form-data” part from the form declaration. I perform the > steps ---
**Author:** ![Long](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e47774/32.png) [@Long](https://www.ruby-forum.com/u/Long)\ **Post date:** [September 1, 2007, 4:31pm UTC](https://www.ruby-forum.com/t/lost-session-with-file-upload/113449/3 "2007-09-01T16:31:16Z")
Hi Long, this is my personal experience, even if you don’t put \_session\_id in any of your form, still the \_session\_id will be sent as part of each request which is stored in the browser side cookies, and these values are of 32-character length, and randomly generated by rails for each success- full authorization and they will be used for serialization of “session” attribute of action\_controller under the directory “tmp/sessions/”. This folder contains “ruby-session-#{\_session\_id}” files which will be red at each request and de-serialized to populate session hash. So, since you hard-coded the value of \_session\_id in your form it always goto that file which contains this value as part of file name, which obviously takes you to a different session than what you usually expect. ---
**Author:** ![Long](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e47774/32.png) [@Long](https://www.ruby-forum.com/u/Long)\ **Post date:** [September 1, 2007, 8:20pm UTC](https://www.ruby-forum.com/t/lost-session-with-file-upload/113449/4 "2007-09-01T20:20:41Z")
Hi, Sorry I should have written ‘Generated View’ instead since it was copied from my Browser using view source. I agree with your point, for browsers with default settings (cookies enabled). However, I don’t think we can (should) trust browsers to pass cookies in all cases. That was my reason for including the session id in a hidden field. It works fine for regular forms on browsers with and without cookies support, and not just with Rails. I believe this is a Rails bug (at least in 1.1.6) and hope someone from Rails Core can use what I’ve document here to investigate further. Regards, – Long ----- Original Message ----- From: “raghukumar” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: “Ruby on Rails: Talk” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Saturday, September 01, 2007 9:30 AM Subject: [Rails] Re: Lost session with file upload - resolved > This folder contains “ruby-session-#{\_session\_id}” files which will be > > > > I’ve search this group for reports of this problem but didn’t find anything useful. > > > > > > I was supposed to be redirected to /home/index where session[:photo\_original\_filename] is > > > > displayed. > > > > > However I was redirected to the Login page instead. This was because my authenticate user > > > filter ---
**Author:** ![Long](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e47774/32.png) [@Long](https://www.ruby-forum.com/u/Long)\ **Post date:** [September 1, 2007, 8:23pm UTC](https://www.ruby-forum.com/t/lost-session-with-file-upload/113449/5 "2007-09-01T20:23:41Z")
If the user agent disables cookies, there’s not much point to trying to use session, is there? Rein ---
**Author:** ![Long](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/e47774/32.png) [@Long](https://www.ruby-forum.com/u/Long)\ **Post date:** [September 1, 2007, 10:32pm UTC](https://www.ruby-forum.com/t/lost-session-with-file-upload/113449/6 "2007-09-01T22:32:50Z")
Sure, if there is a will there is a way… 😉 [http://edgesoft.ca/blog/read/2](http://edgesoft.ca/blog/read/2) - No-Cookie Session Support plugin – Long ----- Original Message ----- From: [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) To: “Ruby on Rails: Talk” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) Sent: Saturday, September 01, 2007 1:22 PM Subject: [Rails] Re: Lost session with file upload - resolved > If the user agent disables cookies, there’s not much point to trying > to use session, is there? > > Rein > > On Sep 1, 2:17 pm, “Long” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > Hi, > > > > Sorry I should have written ‘Generated View’ instead since it was copied from my Browser using > > view > > source. > > > > I agree with your point, for browsers with default settings (cookies enabled). However, I don’t > > think we can (should) trust browsers to pass cookies in all cases. That was my reason for > > including > > the session id in a hidden field. It works fine for regular forms on browsers with and without > > cookies support, and not just with Rails. > > > > I believe this is a Rails bug (at least in 1.1.6) and hope someone from Rails Core can use what > > I’ve > > To: “Ruby on Rails: Talk” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > > > > > authorization and they will be used for serialization of “session” > > > > > > > > > > > > I removed the above line and the file upload work as expected (well almost). It seems there > > > > is > > > > ----- Original Message ----- > > > > > > > > > redirect\_to :controller =\> 'home', :action =\> 'index' failed when it shouldn't. > > > > > > > I figure the session may have changed so I recorded the session\_id before and after > > > > > [Upload] > > > > > button > > > > > was pressed. They were indeed different. > > > > > > > Next, I remove the enctype=“multipart/form-data” part from the form declaration. I perform > > > > > the > > > > > steps > > > > > again and was redirected /home/index, as expected (with my current session remained in > > > > > tact).