# Session / cookie confusion

**URL:** <https://www.ruby-forum.com/t/session-cookie-confusion/165091>\
**Category:** Rails\
**Created:** [April 9, 2009, 12:40am UTC](https://www.ruby-forum.com/t/session-cookie-confusion/165091 "2009-04-09T00:40:15Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![msp](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ac8455/32.png) [@msp](https://www.ruby-forum.com/u/msp)\
**Post date:** [April 9, 2009, 12:40am UTC](https://www.ruby-forum.com/t/session-cookie-confusion/165091/1 "2009-04-09T00:40:15Z")

</div>

Hi list

I’m in need of a little clarification. I thought that value set in the  
ApplicationController  
would result in a session cookie being created that is unique for that  
user’s session i.e. until the browser is closed?

session :session\_key =\> ‘\_myapp\_session\_id’

I am seeing the same cookies[:’\_myapp\_session\_id’] value reported  
across different browsers, with different sessions on different  
machines.

Can anyone explain or correct my misundestanding?

Thanks muchly

Matt

(rails 2.2.2 under passenger)

---

<div class="post-metadata">

**Author:** ![msp](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ac8455/32.png) [@msp](https://www.ruby-forum.com/u/msp)\
**Post date:** [April 9, 2009, 12:47am UTC](https://www.ruby-forum.com/t/session-cookie-confusion/165091/2 "2009-04-09T00:47:17Z")

</div>

On Apr 8, 11:38 pm, msp [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Hi list
> 
> I’m in need of a little clarification. I thought that value set in the  
> ApplicationController  
> would result in a session cookie being created that is unique for that  
> user’s session i.e. until the browser is closed?

What do you mean by set ?

> session :session\_key =\> ‘\_myapp\_session\_id’
> 
> I am seeing the same cookies[:‘\_myapp\_session\_id’] value reported  
> across different browsers, with different sessions on different  
> machines.
> 
> Can anyone explain or correct my misundestanding?

The default session store encodes the contents of the session itself  
in the cookie (ie if different people end up storing the same thing in  
the session they will end up with basically the same session cookie).

Fred