# Setting Session Options in Rails 2.3

**URL:** <https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602>\
**Category:** Rails\
**Created:** [March 23, 2009, 1:45am UTC](https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602 "2009-03-23T01:45:26Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 23, 2009, 1:45am UTC](https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602/1 "2009-03-23T01:45:26Z")

</div>

I’m trying to figure out how I should set my session options for Rails  
2.3. In Rails 2.2:

session :cookie\_only =\> false, :only =\> :swf\_upload

In Rails 2.3, it looks like I need to use:

request.session\_options[‘cookie\_only’] = false

But how do I tell it that I only want that option on a specific method  
in the controller (the :only option)?

Thanks!  
Tom

p.s. The old way works, but the deprecation warnings are driving me  
nuts when I run my tests.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 23, 2009, 11:08am UTC](https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602/2 "2009-03-23T11:08:49Z")

</div>

I am having exactly the same problem. However, for me, old:

class ImagesController \< ApplicationController  
session :cookie\_only =\> false  
end

does _not_ work anymore. TomRossi7, can you double check does it work  
for you, please?

The only way I worked this around, is to get sessions directly from  
SessionStore, which is extremely bad. Also I can’t find tests  
regarding cookie\_only option in 2.3.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [March 23, 2009, 7:22pm UTC](https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602/3 "2009-03-23T19:22:11Z")

</div>

Have you tried using the following in your controller?

session\_options[‘cookie\_only’] = false

I think that will work, I just don’t know how to specify which methods  
I want to apply the option.

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [September 10, 2009, 6:49pm UTC](https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602/4 "2009-09-10T18:49:25Z")

</div>

hello Martin, Please forgive my terrible english.

I tried your mokye patch,  
but it didn’t work well.

I tried like next,

* * *

class Mobile::BaseController \< ApplicationController  
before\_filter :cookie\_only\_off

protected

def cookie\_only\_off  
RAILS\_DEFAULT\_LOGGER.info “call set optiion” # LOGGING  
request.session\_options[:cookie\_only] = false  
end  
end

module ActionController  
module Session  
class AbstractStore  
private  
def load\_session(env)  
RAILS\_DEFAULT\_LOGGER.info “call load\_session” # LOGGING  
request = Rack::Request.new(env)  
key = request.session\_options[:key]  
cookie\_only = request.session\_options[:cookie\_only]  
sid = request.cookies[key]  
unless cookie\_only  
sid ||= request.params[key]  
end  
sid, session = get\_session(env, sid)  
[sid, session]  
end  
end  
end  
end

* * *

I watched my log,  
Logger said “call load\_session”, “call set optiion”.

I think the load\_session method called first,  
so I cannot set “cookie\_only option”.

Can I get another way of setting “cookie\_only option” ?

Thank you for reading my terrible english.

–  
densya

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [September 9, 2009, 8:11am UTC](https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602/5 "2009-09-09T08:11:59Z")

</div>

Hi all,

Reviving this old thread with a I am developing a site that needs to be  
accessible to mobile phones, and I am having issues with session  
tracking.

While the default “cookie\_only” session tracking makes a lot of sense  
(it prevents session fixation attacks), there are these cases when your  
clients do not support cookies (say, many mobile phones, for example)  
and you just need to do request-parameter-based session tracking.

One should be able to use the “cookie\_only” session option and set it to  
“false” where appropriate, but this is seriously broken in Rails 2.3.  
From my tests so far:

1. Setting a default by adding “config.action\_controller.session =  
{:cookie\_only =\> false}” in environment.rb DOES work.

2. Inside your controller (say, a before\_filter method),  
“request.session\_options[:cookie\_only] = false” to false will NOT work.

Unfortunately, 1) is not an acceptable solution, as it opens the whole  
site to session fixation attacks.

FWIW, I think I have traced down the culprit to the load\_session method  
in active\_store.rb around line 165:

```
      sid = request.cookies[@key]
      unless @cookie_only
        sid ||= request.params[@key]
      end

```

This code becomes a problem in 2.3, because the session has been pushed  
down to the Rack middleware layer, where your abstract\_store gets  
initialized once and for all, way before any of your controller code  
gets executed. As a result, your abstract\_store’s @cookie\_only and @key  
are set once and for all, according to the default session options. Any  
further changes to the session\_options[:cookie\_only] or  
session\_options[:key] will simply be ignored.

Here is a tentative monkey patch that restores the proper functionality  
of session\_options[:cookie\_only] and session\_options[:key].

HTH.

#######################################################################

# Monkey patch to allow per-controller/action setting of :cookie\_only

# and :key session options

#######################################################################

module ActionController  
module Session  
class AbstractStore

```
  private
  def load_session(env)
    request = Rack::Request.new(env)
    key = request.session_options[:key]
    cookie_only = request.session_options[:cookie_only]
    sid = request.cookies[key]
    unless cookie_only
      sid ||= request.params[key]
    end
    sid, session = get_session(env, sid)
    [sid, session]
  end

end

```

end  
end

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [September 12, 2009, 6:12am UTC](https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602/6 "2009-09-12T06:12:03Z")

</div>

hello Martin, thank you for your answer!!

Unfortunately, the problem still be here, but,  
thank you for telling me the debugging way!  
it is very useful!! ^^)

## – densya

---

<div class="post-metadata">

**Author:** ![casper\_the\_ghost](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/58956e/32.png) [@casper\_the\_ghost](https://www.ruby-forum.com/u/casper_the_ghost)\
**Post date:** [September 11, 2009, 4:01am UTC](https://www.ruby-forum.com/t/setting-session-options-in-rails-2-3/163602/7 "2009-09-11T04:01:02Z")

</div>

スクルト神守 wrote:

> hello Martin, Please forgive my terrible english.
> 
> I tried your mokye patch,  
> but it didn’t work well.

Yes, I just found out myself the patch is only a partial solution: it  
worked on my simple prototype, but once integrated into my production  
system, it stopped working. Like you, I found that “load session” was  
happening before “set option”.

The problem is that the session is automatically loaded as soon as  
something tries to use it. So if some plugin uses the session before  
your controller gets control, then the session will be loaded before  
your before\_filter can set the options correctly.

What you can do to find the culprit: use the ruby debugger and add a  
“debugger” statement inside the load\_session monkey patch function, then  
run your server with “script/server --debugger”. When you try to access  
you site, your console will drop into the debugger, and you can issue a  
“where” command, that will give you a stack trace, so you can find out  
what triggered the call to load\_session.

In my case, it was the render\_component plugin.

Unfortunately, I do need the render\_component plugin (for my admin pages  
that use ActiveScaffold)…

So, the problem is still open… Can anyone help? Should I fill a bug  
report?

–  
Yves-Eric Martin