CODEWITHSUNDEEP
ruby-on-railscookiessession-cookiescookiestore
Mysterywood
Mysterywood

Reputation: 1668

Why does Rails give assign me an _app_session cookie even though I am not logged in?

I'd like to understand the behavior of Rails of why am I given a session cookie even though I am not logged in. Does it serve any purpose and what are the potential use cases for it (aside from authentication after logging in)?

Upvotes: 0

Views: 456

Answers (1)

Jussi Hirvi
Jussi Hirvi

Reputation: 725

In a Rails app, ActionController provides a session for each user. It can be used to store small amounts of data that will be persisted between requests.

Sessions can use many kinds of data stores, but always there is a cookie which stores the unique session ID. The default is to store everything else in the cookie too.

The cookie is signed and encrypted, so it can easily be used to store sensitive data, for example session[:user_id] = your_current_user_id.

More info here.

Upvotes: 2

Related Questions