CODEWITHSUNDEEP
ruby-on-railssessionrestful-authentication
mike in africa
mike in africa

Reputation: 218

Losing session in rails 2.3.2 app using subdomain

I have a 2.2.3 app which I upgraded to 2.3.2

It's a multi-site (using subdomain) that creates one top level session for all sites.

This is how I change the domain in production.rb:

ActionController::Base.session_options[:domain] = "example.com"

# in rails 2.2.2, this is what i used to do:
# ActionController::Base.session_options[:session_domain] = "example.com"

Strange things started to happen after I upgraded I can no longer log in using restful authentication; it does authenticate me, but as soon as I'm redirected, it would ask me to log in again.

As I said, I use restful_authentication and I also use passenger 2.1.2. Can anyone help?

Upvotes: 5

Views: 6028

Answers (10)

vladr
vladr

Reputation: 66661

You must indicate:

.example.com

(notice the leading dot) in order for the session cookie to apply to example.com as well as its sub-domains.

Upvotes: 1

Brian Armstrong
Brian Armstrong

Reputation: 19863

Olly's answer is correct, in rails 2.3 it should be:

config.action_controller.session[:domain] = '.example.com'

I just wanted to add that if you don't already have some session options created you may receive this when using that:

undefined method `[]=' for nil:NilClass

In that case you should use this instead (which creates the session variable instead of updating it):

config.action_controller.session ||= {}
config.action_controller.session[:domain] = '.example.com'

Edit: apparently Rails 2.2.2 projects use something different. "domain" should be named "session_domain" and take the period character off the front of the domain. Try this:

config.action_controller.session ||= {}
config.action_controller.session[:session_domain] = 'example.com'

Upvotes: 7

Andrey Prihodko
Andrey Prihodko

Reputation: 456

It could be added in the same place where you set the session key and secret

config.action_controller.session = {
      :key => '_app_session',
      :domain => '.domain.com',
      :secret => 'secret'
}

Upvotes: 0

Noah W. Smith
Noah W. Smith

Reputation: 79

I'm also running 2.3.5 and encountering similar issues to @alfred-nerstu

No error messages with the patch from @schickm but it doesn't seem to take, either.

Upvotes: 0

schickm
schickm

Reputation: 175

A more bullet proof solution would be to check if the session already exists or not. If you are blindly replacing the whole session object it may trip you up in the future.

if ActionController::Base.session
  ActionController::Base.session[:domain] = '.example.com'
else
  ActionController::Base.session = { :domain => '.example.com' }
end

I like to do this in an initializer file.

Upvotes: 2

Alfred
Alfred

Reputation: 7091

I'm running Rails 2.3.5 and have 

config.action_controller.session = {:domain => '.localhost:3000'}

in my development.rb but I don't get it to work?

Something else you need to do?

Upvotes: 1

Dan Rosenstark
Dan Rosenstark

Reputation: 69757

Just wanted to mention that another way to handle the whole subdomain thing for the cookies is dynamically. Works in 2.3.4.

Something like this in the environment.rb

# solution to use the cookies in the api. domains
# this is relevant but in 2.3.4 the code is different
# http://szeryf.wordpress.com/2008/01/21/cookie-handling-in-multi-domain-applications-in-ruby-on-rails/
# Just making sure that api. shares the domain name
require 'dispatcher'
module ActionController
  class Dispatcher
    def set_session_domain
      host_name = @env['SERVER_NAME']
      new_host_name = whatever #some mod of the host_name, for instance
      ActionController::Base.session = {
        :domain => new_host_name
      }
    end

    before_dispatch :set_session_domain
  end
end

Upvotes: 1

Olly
Olly

Reputation: 7758

In Rails 2.3 you should use

config.action_controller.session[:domain] = '.example.com'

Upvotes: 3

tal
tal

Reputation: 3433

we had the same problem (losing sessions, without subdomain), with nginx + thin. Migrating to apache + passenger (last version) fixed the problem.

Upvotes: 0

arfon
arfon

Reputation: 1131

I had the same problem with cookie-based sessions. Upgrading to Passenger 2.1.3 seemed to fix the issue.

Upvotes: -1

Related Questions