# Sessions w/o cookies still broken

**URL:** <https://www.ruby-forum.com/t/sessions-w-o-cookies-still-broken/47787>\
**Category:** Rails\
**Created:** [November 13, 2005, 11:50pm UTC](https://www.ruby-forum.com/t/sessions-w-o-cookies-still-broken/47787 "2005-11-13T23:50:32Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![mannl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f04885/32.png) [@mannl](https://www.ruby-forum.com/u/mannl)\
**Post date:** [November 13, 2005, 11:50pm UTC](https://www.ruby-forum.com/t/sessions-w-o-cookies-still-broken/47787/1 "2005-11-13T23:50:32Z")

</div>

Supporting sessions without cookies is still broken in Rails.

One can add the \_session\_id to each link using something like this:

class ActionController::Base  
def default\_url\_options(options)  
{ ‘\_session\_id’ =\> session.session\_id }  
end  
end

BUT the problem is that doesn’t work when you have an upload form  
(because of a bug in Rails/CGI.rb).

See this ticket: [Peak Obsession](http://dev.rubyonrails.com/ticket/210)

Does anyone know how to fix for this? I really wish I could support  
users without cookies in my upcoming commercial application, but it’s  
just not possible, because of that bug (and I’ve been trying to find  
a solution for this for over two weeks now).

I looked into the code, but I don’t understand it so very well, it’s  
confusing for me, so I didn’t manage to fix it myself.

I really think it would be a good idea if Rails had this fixed this  
for 1.0. Not every programmer has the freedom to just block users  
that accept no cookies. I wish I did, but I must support them.

Robert

---

<div class="post-metadata">

**Author:** ![mannl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f04885/32.png) [@mannl](https://www.ruby-forum.com/u/mannl)\
**Post date:** [November 14, 2005, 11:08am UTC](https://www.ruby-forum.com/t/sessions-w-o-cookies-still-broken/47787/2 "2005-11-14T11:08:46Z")

</div>

I guess no one cares about users that have cookies disabled =)

Maybe someone can help me with this one: I tried recreating the  
session object myself, like this:

before\_filter :recreate\_session  
def recreate\_session  
session = CGI::Session.new(CGI.new, :session\_id =\> params  
[:\_session\_id]) if(params[:\_session\_id])  
end

That doesn’t seem to work though. It creates a new session instead of  
the one with the params[:\_session\_id]

Does anyone know how I can get that to work? If I at least can get  
this hack to work, then I finally can use Rails in production.

Rob

---

<div class="post-metadata">

**Author:** ![mannl](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/f04885/32.png) [@mannl](https://www.ruby-forum.com/u/mannl)\
**Post date:** [November 14, 2005, 11:12am UTC](https://www.ruby-forum.com/t/sessions-w-o-cookies-still-broken/47787/3 "2005-11-14T11:12:21Z")

</div>

Nevermind! Matthew seems to have found a fix

He will post it when he has the time

Check the ticket

Rob