CODEWITHSUNDEEP
ruby-on-rails-3cookiesherokudeviseruby-on-rails-3.2
JDStraughan
JDStraughan

Reputation: 317

Wildcard subdomain cookies ignored in some browsers. Rails 3.2 app on Heroku

I have a rails 3.2 app on Heroku using Devise.

Starting after a deploy yesterday, the session_id quit being stored on some browsers.

After a debugging marathon, we discovered that our cookies were being set up like this:

Application.config.session_store :cookie_store, :domain => :all

This was sending the set cookie header with a domain of .herokuapp.com, allowing us to visit our development, staging, etc.

This code has been working for > 1 year. Yesterday, after a deploy, the bug arose.

The fix was setting the domain explicitly, using the actual subdomain in the cookie domain:

Application.config.session_store :cookie_store, :domain => 'example.herokuapp.com'

While this "fixed" the problem, I have not figured out why this cookie was being ignored by some browsers, but not others. They should all allow wildcard subdomain cookies AFAIK.

Please help me understand this issue.

Upvotes: 2

Views: 1147

Answers (1)

JDStraughan
JDStraughan

Reputation: 317

On May 14, 2013, herokuapp.com was added to the Mozilla Foundation’s Public Suffix List. This list is used in several browsers (Firefox, Chrome, Opera) to limit how broadly a cookie may be scoped.

Source: https://devcenter.heroku.com/articles/cookies-and-herokuapp-com

Upvotes: 6

Related Questions