CODEWITHSUNDEEP
javascriptphpruby-on-rails-4cookiessession-cookies
agent provocateur
agent provocateur

Reputation: 830

Read Rails 4 Cookie/Session with Javascript

Is there a way to read/decode the contents of a Rails 4 cookie/session into another language such as Javascript or PHP? How?

I have read that this is possible to do so with Rails 3 cookies, but with Rails 4 something about the 2-way encryption makes it difficult/not possible.

Currently, our app uses Rails 3, but I am looking to upgrade and the upgrade will upgrade to Rails 4, so I am trying to see how viable it is to be able to read cookie info from Rails 4 cookies.

Upvotes: 0

Views: 767

Answers (1)

devkaoru
devkaoru

Reputation: 1162

it depends on which cookie you're talking about.

Session cookies cannot be read by javascript because they have the secure flag. You can hover see your cookies in the dev tools:

enter image description here

Regular cookies can be access in javascripts using document.cookie

I'm not familiar with PHP but if you make a request against a Rails server you will get a Set-Cookie header which will allow you to read the cookies being set by Rails. You can then decrypt the session cookie using the secret_key_base from your Rails app. Though this is highly discourage. I would using something like JWT http://jwt.io/ to share secret information between your Rails stack and your PHP stack. I.e. creating an endpoint on the Rails side that returns an encrypted response which the PHP server decrypts using a shared key.

For more info: http://guides.rubyonrails.org/security.html#session-storage

Upvotes: 1

Related Questions