jeremywoertink
jeremywoertink

Reputation: 2341

Understanding Web session id WRT rails

I'm working on a way to carry sessions between a Rails app, and a Kemal app. I can do this manually for now, but there's this library for kemal that allows for extending how sessions are handled. I have started it here.

My question is, when I decrypt a session cookie value from rails, I'm given a hash that contains a session_id key with some value like 0cc175b9c0f1b6a831c399e269772661. How is this session_id generated? When I extend the engine here, would this be the same session_id I would need to pass around? Or would the entire session cookie value be considered the "id"?

Here's a sample of how it's decrypted in rails:

secret_key_base = "a0aaa0a00a000a00a0a0aa00a0aa000a000aa0a0a0a0a0000a0000a00aaa00000000aa0aa00000000a00000a000a000000a00aaa0a0000000a0000a0a0aaa000"
key_generator = ActiveSupport::CachingKeyGenerator.new(ActiveSupport::KeyGenerator.new(secret_key_base, iterations: 1000))
secret = key_generator.generate_key("encrypted cookie")
sign_secret = key_generator.generate_key("signed encrypted cookie")
encryptor = ActiveSupport::MessageEncryptor.new(secret, sign_secret, serializer: JSON)
hash = encryptor.decrypt_and_verify("SOME_REALLY_LONG_STRING")
puts hash["session_id"] #=> 0cc175b9c0f1b6a831c399e269772661

EDIT (for clarification): I currently have 2 rails apps that share session between them. My goal is to replace one of the rails apps with a kemal app. I currently have this working from rails -> kemal, but going kemal -> rails doesn't work.

How does rails generate that session_id value? Should I be generating this value the same way in kemal?

Upvotes: 1

Views: 207

Answers (0)

Related Questions