# Session IDs and SWFUpload

**URL:** <https://www.ruby-forum.com/t/session-ids-and-swfupload/82263>\
**Category:** Rails\
**Created:** [January 18, 2007, 4:45pm UTC](https://www.ruby-forum.com/t/session-ids-and-swfupload/82263 "2007-01-18T16:45:15Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Peter\_De\_Berdt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/53a042/32.png) [@Peter\_De\_Berdt](https://www.ruby-forum.com/u/Peter_De_Berdt)\
**Post date:** [January 18, 2007, 4:45pm UTC](https://www.ruby-forum.com/t/session-ids-and-swfupload/82263/1 "2007-01-18T16:45:15Z")

</div>

Hi

I’m using SWFUpload in one of my applications, but it has one big  
shortcoming: it doesn’t maintain the session. Let me explain:

The user has to login to the application, thus creating an  
authenticated session (cookie \_session\_id client side and the  
sessions table server side). However, when you use SWFUpload, the  
upload script is called with a new session (unauthenticated), making  
the app assume the new session has no access and redirects it to the  
login page.

Currently, I’ve just exposed the upload methods, so that they don’t  
require authentication. However, this is like locking your front  
door, but leaving the back door wide open.

Apparently, the only way for a Flash file to pass on parameters, is  
using GET. I can append the \_session\_id cookie value to the upload  
URL, but I can’t seem to get Rails to use this \_session\_id value  
(params[:\_session\_id] instead of the one passed in the HTTP headers.

Is it somehow possible to override the HTTP header cookie \_session\_id  
in favor of one that is passed as a GET parameter, but only for the  
upload\_file method, so that the authenticated state is still recognized?

Best regards

Peter De Berdt

---

<div class="post-metadata">

**Author:** ![Peter\_De\_Berdt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/53a042/32.png) [@Peter\_De\_Berdt](https://www.ruby-forum.com/u/Peter_De_Berdt)\
**Post date:** [January 18, 2007, 4:53pm UTC](https://www.ruby-forum.com/t/session-ids-and-swfupload/82263/2 "2007-01-18T16:53:17Z")

</div>

Never heard of SWF upload. Why not use acts\_as\_attachment instead?  
Widely used, nicely tested and written by a rails core dev.

[http://svn.techno-weenie.net/projects/plugins/acts\_as\_attachment/](http://svn.techno-weenie.net/projects/plugins/acts_as_attachment/)

---

<div class="post-metadata">

**Author:** ![Peter\_De\_Berdt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/53a042/32.png) [@Peter\_De\_Berdt](https://www.ruby-forum.com/u/Peter_De_Berdt)\
**Post date:** [January 21, 2007, 3:05am UTC](https://www.ruby-forum.com/t/session-ids-and-swfupload/82263/3 "2007-01-21T03:05:59Z")

</div>

> > 
> 
> – fxn  
> I came across the same problem recently and this solved it nicely:

[http://blog.inquirylabs.com/2006/12/09/getting-the-\_session\_id-from-swfuploa](http://blog.inquirylabs.com/2006/12/09/getting-the-_session_id-from-swfuploa)  
d/

hth

–  
Richard L.  
Head of Agile Development, CitySafe

[http://citysafe.org](http://citysafe.org) … CitySafe  
[http://thatsprogress.com](http://thatsprogress.com) … The Fitness Community (soon)  
[http://livsey.org](http://livsey.org) … Blog : Musings of a Rails Developer

---

<div class="post-metadata">

**Author:** ![Peter\_De\_Berdt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/53a042/32.png) [@Peter\_De\_Berdt](https://www.ruby-forum.com/u/Peter_De_Berdt)\
**Post date:** [January 21, 2007, 1:03am UTC](https://www.ruby-forum.com/t/session-ids-and-swfupload/82263/4 "2007-01-21T01:03:51Z")

</div>

On Jan 18, 2007, at 4:51 PM, removed\_email\_address@domain.invalid wrote:

> Never heard of SWF upload. Why not use acts\_as\_attachment instead?  
> Widely used, nicely tested and written by a rails core dev.
> 
> [http://svn.techno-weenie.net/projects/plugins/acts\_as\_attachment/](http://svn.techno-weenie.net/projects/plugins/acts_as_attachment/)

They are not comparable. SWFupload is a flash file-upload widget with  
lots of features, see

[http://labb.dev.mammon.se/swfupload/](http://labb.dev.mammon.se/swfupload/)

– fxn

---

<div class="post-metadata">

**Author:** ![Peter\_De\_Berdt](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/53a042/32.png) [@Peter\_De\_Berdt](https://www.ruby-forum.com/u/Peter_De_Berdt)\
**Post date:** [January 21, 2007, 3:30pm UTC](https://www.ruby-forum.com/t/session-ids-and-swfupload/82263/5 "2007-01-21T15:30:03Z")

</div>

On 21 Jan 2007, at 03:05, Richard L. wrote:

> I came across the same problem recently and this solved it nicely:
> 
> [http://blog.inquirylabs.com/2006/12/09/getting-the-\_session\_id-from-](http://blog.inquirylabs.com/2006/12/09/getting-the-_session_id-from-)  
> swfuploa  
> d/

This is just great, a big thanks to you Richand and to Duane!

Best regards

Peter De Berdt