# Swfupload, and uploading via an authenticated session **URL:** \ **Category:** Rails\ **Created:** [January 19, 2008, 9:24pm UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583 "2008-01-19T21:24:23Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![KenM](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bc79bd/32.png) [@KenM](https://www.ruby-forum.com/u/KenM)\ **Post date:** [January 19, 2008, 9:24pm UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583/1 "2008-01-19T21:24:23Z")
I’m constructing a site which requires authenticated uploads. I’ve found the swfupload tool, which works really well with with attachment\_fu. However, I’m having a heck of a time getting the uploads to work over an authenticated session. I’ve implemented this code ([http://inquirylabs.com/downloads/](http://inquirylabs.com/downloads/) get\_session\_id\_from\_query\_string\_on\_post.rb) via environment.rb, but I can’t get it work work properly, since I get HTTP 500 errors when I try an post to a url that has embedded URL parameters. What I’m trying to do is this: window.onload = function () { swfu = new SWFUpload({ upload\_url : ‘\<%= swfupload\_photos\_path %\>?\_acp\_session=\<%= session.session\_id %\>’, … when I try to upload the request, I see a POST in the rails log as follows: 127.0.0.1 - - [19/Jan/2008:12:41:57 Mountain Standard Time] "POST / photos/swfupload?\_acp\_session=BAh7CToMdXNlcl9pZGkGOg… so the session id is being inserted into the string. However, a HTTP 500 is generated before the CGI::Session object is every instantiated, and I don’t know why - there are no error messages in the log that indicate where the error is occurring. I’ve tried to escape the query string, and while that seems to work ‘better’ (I get the 500 later in the request), it still doesn’t work. Ideally, a pointer to some demo code that implements swfUpload and session id passing would be great. I’m on the latest released version of Rails: 2.0.2. ---
**Author:** ![KenM](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bc79bd/32.png) [@KenM](https://www.ruby-forum.com/u/KenM)\ **Post date:** [January 19, 2008, 9:51pm UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583/2 "2008-01-19T21:51:28Z")
Bit of an update - I’ve changed the swfUpload javascript object to look like this now: window.onload = function () { swfu = new SWFUpload({ upload\_url : ‘\<%= swfupload\_photos\_path %\>’, post\_params: { ‘\_acp\_session’ : ‘\<%= session.session\_id %\>’ }, … which is much cleaner. However, it still doesn’t work ☹ The issue seems to be that CGI::Session doesn’t seem to be accepting the session id, since my before filter (which looks for a login id, indicating that the user has authenticated) comes up empty. I’m currently digging into CGI::Session, but as of yet, no joy. ---
**Author:** ![KenM](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bc79bd/32.png) [@KenM](https://www.ruby-forum.com/u/KenM)\ **Post date:** [January 20, 2008, 11:48am UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583/3 "2008-01-20T11:48:17Z")
On 19 Jan 2008, at 21:50, KenM wrote: > ``` > ... > > ``` > > which is much cleaner. However, it still doesn’t work ☹ > > The issue seems to be that CGI::Session doesn’t seem to be accepting > the session id, since my before filter (which looks for a login id, > indicating that the user has authenticated) comes up empty. I’m > currently digging into CGI::Session, but as of yet, no joy. IIRC, Rails 2 introduced security measures that will prevent sessions to be passed as parameters from now on. Now, the problem is that Flash currently offers no way of passing cookies the way Rails expects it to. I also like using SWFUpload in my projects, so I’m really interested in a solution that doesn’t involve exposing the swfupload method as non-authenticated or using some kind of alternative authentication token like method (e.g. use a hashed value as a parameter and compare it to a hashed value in the users table). Best regards Peter De Berdt ---
**Author:** ![KenM](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bc79bd/32.png) [@KenM](https://www.ruby-forum.com/u/KenM)\ **Post date:** [January 20, 2008, 9:54pm UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583/4 "2008-01-20T21:54:07Z")
I was wondering if there was something in Rails 2 that was causing my difficulties…I’m not going to give up yet, but I think for the time being a token-based solution will suffice - not entirely secure, but ‘good enough’ for what I’m doing… ---
**Author:** ![KenM](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bc79bd/32.png) [@KenM](https://www.ruby-forum.com/u/KenM)\ **Post date:** [January 21, 2008, 2:50pm UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583/5 "2008-01-21T14:50:20Z")
We faced the same problem after upgrading to rails 2.0, and we have it solved in the following way. First of all, we set the session option to allow only the upload action to accept the session id outside a cookie (in post or get format): session :cookie\_only =\> false, :only =\> %w(attachment) then we create a session\_patch.rb in config/initializers, with the following ocntent: class CGI::Session alias original\_initialize initialize # The following code is a work-around for the Flash 8 bug that prevents our multiple file uploader # from sending the \_session\_id. Here, we hack the Session#initialize method and force the session\_id # to load from the query string via the request uri. (Tested on Lighttpd, Mongrel, Apache) def initialize(cgiwrapper, option = {}) #RAILS\_DEFAULT\_LOGGER.debug “#{ **FILE** }:#{ **LINE** } Session options #{ option.inspect} \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*” unless option[‘cookie\_only’] #RAILS\_DEFAULT\_LOGGER.debug “#{ **FILE** }:#{ **LINE** } Initializing session object #{cgiwrapper.env\_table[‘RAW\_POST\_DATA’]} \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*” session\_key = option[‘session\_key’] || ‘\_session\_id’ ``` query_string = if (rpd = cgiwrapper.env_table['RAW_POST_DATA']) ``` and rpd != ‘’ rpd elsif (qs = cgiwrapper.env\_table[‘QUERY\_STRING’]) and qs != ‘’ qs elsif (ru = cgiwrapper.env\_table[‘REQUEST\_URI’][0…-1]).include?(‘?’) ru[(ru.index(‘?’) + 1)…-1] end if query\_string and query\_string.include?(session\_key) option[‘session\_id’] = query\_string.scan(/#{session\_key}=(._?)(&._?)\*$/).flatten.first end end ``` original_initialize(cgiwrapper,option) ``` end end On Jan 20, 2008 6:53 PM, KenM [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > > > ``` > > > ... > > > > > > ``` > > > > Flash currently offers no way of passing cookies the way Rails > > Peter De Berdt – Eider Oliveira Site: [http://eider.eti.br](http://eider.eti.br) Blog: [http://eider.eti.br/Home/Blog/Blog.html](http://eider.eti.br/Home/Blog/Blog.html) “If I had more time, I’d have written you a shorter letter.” Pascal ---
**Author:** ![KenM](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bc79bd/32.png) [@KenM](https://www.ruby-forum.com/u/KenM)\ **Post date:** [January 29, 2008, 4:11pm UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583/6 "2008-01-29T16:11:21Z")
On 21 Sty, 14:49, “Eider Oliveira” [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > class CGI::Session > option.inspect} \*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*" > qs > end > > > being a token-based solution will suffice - not entirely secure, but > > > > > > ``` > > > > upload_url : '<%= swfupload_photos_path %>', > > > > > > > > ``` > > > > > > > > indicating that the user has authenticated) comes up empty. I’m > > > > token like method (e.g. use a hashed value as a parameter and compare > > > > Blog:[http://eider.eti.br/Home/Blog/Blog.html](http://eider.eti.br/Home/Blog/Blog.html) > > “If I had more time, I’d have written you a shorter letter.” Pascal Hi, For me this solution works but only with Internet Explorer 7. I have not tried the IE6 but anyway it does not work with Firefox. Has anyone invented some fix for that. Regards, Lukasz ---
**Author:** ![KenM](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bc79bd/32.png) [@KenM](https://www.ruby-forum.com/u/KenM)\ **Post date:** [October 6, 2008, 10:00am UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583/7 "2008-10-06T10:00:42Z")
On 05 Oct 2008, at 03:21, Ho-sheng Hsiao wrote: > [http://blog.isshen.com/2008/10/5/making-swfupload-and-rails-2-1-sessions-work-together](http://blog.isshen.com/2008/10/5/making-swfupload-and-rails-2-1-sessions-work-together) > > I don’t know why it doesn’t work for you. You might be using cookie > session store and passing the session\_id in a way that screws up the > Javascript. > > Anyways, the PHP folks have solved it a different way, by writing a > separate SWF file, pulls the session cookie in from the browser, and > sets a Flash cookie. Works perfectly for me on all browsers (I use the cookie store session, but Jörg got it to work with the activerecord store too): [http://groups.google.com/group/rubyonrails-talk/browse\_thread/thread/45f70281a5992fa7](http://groups.google.com/group/rubyonrails-talk/browse_thread/thread/45f70281a5992fa7) Best regards Peter De Berdt ---
**Author:** ![KenM](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/k/bc79bd/32.png) [@KenM](https://www.ruby-forum.com/u/KenM)\ **Post date:** [October 5, 2008, 3:21am UTC](https://www.ruby-forum.com/t/swfupload-and-uploading-via-an-authenticated-session/126583/8 "2008-10-05T03:21:39Z")
> Hi, > > For me this solution works but only with Internet Explorer 7. I have > not tried the IE6 but anyway it does not work with Firefox. > Has anyone invented some fix for that. > > Regards, > Lukasz I got it working on Firefox 3 using Rails 2.1. I wrote up about it on my blog: [http://blog.isshen.com/2008/10/5/making-swfupload-and-rails-2-1-sessions-work-together](http://blog.isshen.com/2008/10/5/making-swfupload-and-rails-2-1-sessions-work-together) I don’t know why it doesn’t work for you. You might be using cookie session store and passing the session\_id in a way that screws up the Javascript. Anyways, the PHP folks have solved it a different way, by writing a separate SWF file, pulls the session cookie in from the browser, and sets a Flash cookie. Ho-Sheng H. Isshen Solutions, Inc.