# Moving Back From ActiveRecord Session Store to cookie

**URL:** <https://www.ruby-forum.com/t/moving-back-from-activerecord-session-store-to-cookie/152606>\
**Category:** Rails\
**Created:** [November 5, 2008, 3:54pm UTC](https://www.ruby-forum.com/t/moving-back-from-activerecord-session-store-to-cookie/152606 "2008-11-05T15:54:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/59ef9b/32.png) [@johnk](https://www.ruby-forum.com/u/johnk)\
**Post date:** [November 5, 2008, 3:54pm UTC](https://www.ruby-forum.com/t/moving-back-from-activerecord-session-store-to-cookie/152606/1 "2008-11-05T15:54:14Z")

</div>

A couple months ago I moved from storing sessions in the default cookie  
store to active\_record. Now I kind of want to move back because I am  
not  
sure I see any benefit of it but many negatives i.e. it is not easy on  
my  
over taxed DB server as is.  
The problem is that I thought it was going to be as easy as just  
flipping  
the switch back. But it seems to not be that simple. Once I flipped  
the  
switch I started getting InvalidAuthenticityToken errors on pretty much  
every single form on the site. Before hand I never really got these  
errors  
(but I did sometimes, anyone know why sometimes they would appear and  
not  
other times on the same form) and now I am getting them? How would you  
cleanly move back from active\_record store to cookie?

I really appreciate everyone’s input.

–  
John K.  
removed\_email\_address@domain.invalid

Blog: [http://www.kopanas.com](http://www.kopanas.com)  
Conference: [http://www.cusec.net](http://www.cusec.net)  
Twits: [http://www.twitter.com/kopanas](http://www.twitter.com/kopanas)

---

<div class="post-metadata">

**Author:** ![johnk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/59ef9b/32.png) [@johnk](https://www.ruby-forum.com/u/johnk)\
**Post date:** [November 5, 2008, 5:40pm UTC](https://www.ruby-forum.com/t/moving-back-from-activerecord-session-store-to-cookie/152606/2 "2008-11-05T17:40:38Z")

</div>

You have to:

1. in application.rb, comment :secret =\> …, so you just leave  
“protect\_from\_forgery” uncommented
2. in config/environment.rb, uncomment (or put back)  
config.action\_controller.session = { … }

And you’re all set.