# Redirect\_to and the missing session

**URL:** <https://www.ruby-forum.com/t/redirect-to-and-the-missing-session/175605>\
**Category:** Rails\
**Created:** [September 16, 2009, 1:27pm UTC](https://www.ruby-forum.com/t/redirect-to-and-the-missing-session/175605 "2009-09-16T13:27:14Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![icke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e19adc/32.png) [@icke](https://www.ruby-forum.com/u/icke)\
**Post date:** [September 16, 2009, 1:27pm UTC](https://www.ruby-forum.com/t/redirect-to-and-the-missing-session/175605/1 "2009-09-16T13:27:14Z")

</div>

Hi,

My application responds to a URL along the lines of [http://myapp/xxxx](http://myapp/xxxx)  
where routes.rb determines that xxxx is not an action but an affiliate  
code from a referral from another site. The affiliate is validated  
and then the browser is redirected to the ‘new’ action.

def affiliate  
reset\_session # we should not have any session data set if we  
reach here which we will have if we are testing!  
affiliate = params[:affiliate] # this is parsed by routes.rb  
if Affiliate.validate?(affiliate)  
session[:affiliate\_name] = affiliate  
else  
log.info ‘Invalid affiliate’  
end  
redirect\_to :action =\> ‘new’  
end

when I try to access the session data in the ‘new’ action to pre-  
populate the object with the validated affiliate name, my session data  
is not there. All I have is \_csrf\_token which suggests that I never  
wrote the session in the affiliate action or didn’t send the cookie on  
the redirect.

The response I get is:

[http://myapp:3000/quote/new](http://myapp:3000/quote/new)  
Completed in 120ms (DB: 2) | 302 Found [[http://myapp/xxxx](http://myapp/xxxx)]

Does a 302 not send a cookie back to the browser and therefore the  
‘new’ action is the first action to use the session and just creates a  
new one?

Alternatives? Well I can get it working by passing the affiliate as  
part of the url to the ‘new’ action but this then means the url looks  
messy, and it could be easily modified so I would have to revalidate  
the affiliate all over again.

O.

---

<div class="post-metadata">

**Author:** ![icke](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/i/e19adc/32.png) [@icke](https://www.ruby-forum.com/u/icke)\
**Post date:** [September 16, 2009, 8:49pm UTC](https://www.ruby-forum.com/t/redirect-to-and-the-missing-session/175605/2 "2009-09-16T20:49:15Z")

</div>

An update.

I have just created a very simple sandpit application and it works  
correctly. See below.

class AController \< ApplicationController

def hello  
@content = session[:keepthis]  
end

def parameter  
reset\_session  
session[:keepthis] = params[:affiliate]  
redirect\_to :action =\> ‘hello’  
end

end

and a routes.rb is

map.a “a/:action”,  
:controller =\> “a”

map.a “:affiliate”,  
:controller =\> “a”,  
:action =\> “parameter”,  
:requirements =\> { :affiliate =\> /\w+/ }

Ok. So the new application was generated new on Rails 2.3.4 and the  
misbehaving application was built on 2.3.2 and was upgraded to 2.3.4.  
I will go and check the release notes but if anyone has any pointers  
on this then I would be very grateful.

Thanks.

O.