CODEWITHSUNDEEP
ruby-on-railssessionactiverecord
Neil
Neil

Reputation: 5178

Rails Sessions table attributes, Understanding activerecord-session_store

I am trying to understand the differences between a particular record stored in a sessions table in the database, vs session information stored in a sessions cookie. There is a part in the activerecord-session_store documentation that is confusing to me. Documentation is at: https://github.com/rails/activerecord-session_store

So for whatever reason I want to have a sessions table instead of just using the sessions cookie. I add the gem: gem "activerecord-session_store". I then do rails generate active_record:session_migration which creates the migration that builds the session table in the database once I rake db:migrate.

That sessions table holds two main columns: session_id(which is of type string) and data (which is of type text).

First Question: session_id? what exactly is this referring to? Is the session_id equal to the primary key: id?

My second question revolves around the documentation notes for the column: data. This column is of type text. According to https://msdn.microsoft.com/en-us/library/ms187993.aspx the text datatype's maximum size is 2,147,483,647 bytes, so I would assume that this is the maximum size of bytes that this column can hold. However, the activerecord-session_store documentation states:

data (text or longtext; careful if your session data exceeds 65KB).

It goes on to say this:

If the data you write is larger than the column's size limit, ActionController::SessionOverflowError will be raised.

Second Question: Why is the data column limited to 65KB when the data type text can hold 2,147,483,647 bytes? I thought that one of the main reasons why I might want a sessions table is because I want to store more stuff than a sessions cookie can store (which is 4093 bytes).

Third Question: How do I make it so that the data column can store more than 65KB of info?

Fourth Question: active_record-session_store appears to only encode the data. Is it safe that the data is encoded as opposed to encrypted because the sessions table is located on my server as opposed to in a user's cookie? Is it necessary to encrypt the session's data?

Upvotes: 2

Views: 1579

Answers (1)

Tom
Tom

Reputation: 520


first question: No, session_id and id are not the same (although you can configure it to be the same, as described in the activerecord-session_store documentation).

second question: 65kB is the conventional max. size for text columns - see here. It changes to longtext if more than 65kB are stored (at least i understand it this way, but haven't tried).

third question: see second answer, although i'm not completely sure. I think the more important question is: Why would you store more? ;)

fourth: encoding does not happen because of safety reasons. The data is encoded...

...to store the widest range of binary session data in a text column

(according to this)

Hope this helps!

Upvotes: 1

Related Questions