class ActionDispatch::Session::CookieStore
This cookie-based session store is the Rails default. It is dramatically faster than the alternatives.
Sessions typically contain at most a user ID and flash message; both fit
within the 4096 bytes cookie size limit. A CookieOverflow
exception is raised if you attempt to store more than 4096 bytes of data.
The cookie jar used for storage is automatically configured to be the best possible option given your application's configuration.
Your cookies will be encrypted using your application's
secret_key_base
. This goes a step further than signed cookies
in that encrypted cookies cannot be altered or read by users. This is the
default starting in Rails 4.
Configure your session store in an initializer:
Rails.application.config.session_store :cookie_store, key: '_your_app_session'
In the development and test environments your application's
secret_key_base
is generated by Rails and stored in a
temporary file in tmp/development_secret.txt
. In all other
environments, it is stored encrypted in the
config/credentials.yml.enc
file.
If your application was not updated to Rails 5.2 defaults, the
secret_key_base
will be found in the old
config/secrets.yml
file.
Note that changing your secret_key_base
will invalidate all
existing session. Additionally, you should take care to make sure you are
not relying on the ability to decode signed cookies generated by your app
in external applications or JavaScript before changing it.
Because CookieStore extends
Rack::Session::Abstract::Persisted
, many of the options
described there can be used to customize the session cookie that is
generated. For example:
Rails.application.config.session_store :cookie_store, expire_after: 14.days
would set the session cookie to expire automatically 14 days after
creation. Other useful options include :key
,
:secure
, :httponly
, and :same_site
.
Public Class Methods
# File lib/action_dispatch/middleware/session/cookie_store.rb, line 58 def initialize(app, options = {}) super(app, options.merge!(cookie_only: true)) end
Public Instance Methods
# File lib/action_dispatch/middleware/session/cookie_store.rb, line 62 def delete_session(req, session_id, options) new_sid = generate_sid unless options[:drop] # Reset hash and Assign the new session id req.set_header("action_dispatch.request.unsigned_session_cookie", new_sid ? { "session_id" => new_sid.public_id } : {}) new_sid end
# File lib/action_dispatch/middleware/session/cookie_store.rb, line 69 def load_session(req) stale_session_check! do data = unpacked_cookie_data(req) data = persistent_session_id!(data) [Rack::Session::SessionId.new(data["session_id"]), data] end end
Private Instance Methods
# File lib/action_dispatch/middleware/session/cookie_store.rb, line 78 def extract_session_id(req) stale_session_check! do sid = unpacked_cookie_data(req)["session_id"] sid && Rack::Session::SessionId.new(sid) end end
# File lib/action_dispatch/middleware/session/cookie_store.rb, line 97 def persistent_session_id!(data, sid = nil) data ||= {} data["session_id"] ||= sid || generate_sid.public_id data end
# File lib/action_dispatch/middleware/session/cookie_store.rb, line 103 def write_session(req, sid, session_data, options) session_data["session_id"] = sid.public_id SessionId.new(sid, session_data) end