# Sessions or Hidden fields?

**URL:** <https://www.ruby-forum.com/t/sessions-or-hidden-fields/173089>\
**Category:** Rails\
**Created:** [August 2, 2009, 4:52am UTC](https://www.ruby-forum.com/t/sessions-or-hidden-fields/173089 "2009-08-02T04:52:02Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![railslist](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/65b543/32.png) [@railslist](https://www.ruby-forum.com/u/railslist)\
**Post date:** [August 2, 2009, 4:52am UTC](https://www.ruby-forum.com/t/sessions-or-hidden-fields/173089/1 "2009-08-02T04:52:02Z")

</div>

In my application I need to track user’s application state such as in  
which city or category he/she is in and based on that i need to perform  
a search.

I have 3 options. Use cookies, use sessions or use hidden fields.

Which one is the best choice in terms of performance and security. The  
data being passed is not sensitive, they just query parameters.

Any ideas?

---

<div class="post-metadata">

**Author:** ![railslist](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/65b543/32.png) [@railslist](https://www.ruby-forum.com/u/railslist)\
**Post date:** [August 2, 2009, 9:27am UTC](https://www.ruby-forum.com/t/sessions-or-hidden-fields/173089/2 "2009-08-02T09:27:09Z")

</div>

Rails L. wrote:

> In my application I need to track user’s application state such as in  
> which city or category he/she is in and based on that i need to perform  
> a search.
> 
> I have 3 options. Use cookies, use sessions or use hidden fields.

Think of hidden fields as a shortcut to populate a  
params[:model][:field], so  
the params[:model] is convenient to use.

> Which one is the best choice in terms of performance and security. The  
> data being passed is not sensitive, they just query parameters.

Use a session, because a session _is_ a cookie, and abusing the cookie  
system  
with extra data is tacky - unless the cookie should last a while.

Also consider using the database - this user’s favorite city. The  
database is  
there to write stuff in, sometimes even if you might consider that stuff  
very minor.

–  
Phlip

---

<div class="post-metadata">

**Author:** ![railslist](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/65b543/32.png) [@railslist](https://www.ruby-forum.com/u/railslist)\
**Post date:** [August 4, 2009, 11:28am UTC](https://www.ruby-forum.com/t/sessions-or-hidden-fields/173089/3 "2009-08-04T11:28:45Z")

</div>

you can specify the active\_record store for the session so it is not  
stored as a cookie on the user’s browser, but on the sessions table in  
your database.