CODEWITHSUNDEEP
ruby-on-railssession-store
rkokkelk
rkokkelk

Reputation: 144

Rails how to use an in Memory SessionStore

I'm looking for a way to use an in memory based session store in a Ruby on Rails application. The session contains a masterkey which can only be decrypted when the users logs in. This key should be available during the entire session.

Due to the nature of this key, the content of the session should not be stored anywhere locally. Also I don't want to transfer the content to any external application, such as memcached.

Thus is it possible to just use an in memory based session store similar to PHP or Java SE?

Upvotes: 2

Views: 6240

Answers (3)

Varus Septimus
Varus Septimus

Reputation: 1650

Rails 5

From version 5, Rails no longer creates a config/initializers/session_store.rb file at install.

In rails 5, the default session store is setup internally (to cookie store), and no longer through an application initializer, as was the case up to Rails 4. cf. https://github.com/rails/rails/issues/25181

In a pure Rails 5 app (= non-migrated), to change your session store, e.g. from :cookie_store to :cache_store, you will have to create yourself the config/initializers/session_store.rb file, and then add the relevant instruction:

# Be sure to restart your server when you modify this file.
Rails.application.config.session_store :cache_store, key: '_your_app_session'

Beware that you will need to change the key from '_your_app_session' to match your application name (if for ex your app is named calculator then should be '_calculator_session')...

Upvotes: 7

bukk530
bukk530

Reputation: 1895

You can use a MemoryStore, but it's a really bad practice as it is not shared between machines, so your application will not be scalable.
From a security standpoint there's no real reason you shouldn't transfer this key to an external memcached or redis.
You should secure your production infrastructure as a whole, encrypt any data exchange between your servers, or put them in a trusted network, make good use of firewalls and follow best practices. Your cache servers should be as secure as your app servers, or databases, no excuses.

Upvotes: 0

Jess
Jess

Reputation: 448

You can use a CacheStore to store session data in-memory.

# /config/initializers/session_store.rb
AppName::Application.config.session_store :cache_store

Or you can write your own SessionStore class:

http://guides.rubyonrails.org/configuring.html#rails-general-configuration

Upvotes: 3

Related Questions