Rails 3 Session Secret and Session Store

Wed Apr 07 20:30:00 -0700 2010

In Rails 3 the location and way you declare the session secret and session store have changed.

Rails 3 Session Secret and Session Store

In Rails 3 the location and way you declare the session secret and session store have changed.

Previously (in 2.3.x) you would have one file:

config/initializers/session_store.rb



ActionController::Base.session = {

  :key         => ‘_my_app_name_session’,

  :secret      => ‘somereallylongrandomkey’

}

In Rails 3, you reduce session_store.rb to the following:

Rails.application.config.session_store :cookie_store, :key => "_my_app_name_session"

And then, because we now need somewhere to store the secret, you create a new file called config/initializers/cookie_verification_secret.rb and put inside of it:

Rails.application.config.cookie_secret = 'somereallylongrandomkey'

If instead of using cookies, you were using active record as the store, then you obviously wouldn’t need the cookie_verification_secret.rb file and instead would insert any other config you needed into its own file inside of initializers.

This gives us the added bonus of being able to exclude cookie secrets from source control systems.

blogLater

Mikel

  1. delaserug Says:
    Tue Nov 08 19:42:40 -0800 2011

    I like your website very much , i t is very excellent ! Thank you for your sharing !

  2. Biomass Pellet Mill Says:
    Mon Aug 08 02:13:21 -0700 2011

    I like your website very much , i t is very excellent ! Thank you for your sharing !

  3. Techs Review Says:
    Fri Oct 07 00:24:56 -0700 2011

    I do not like cookies, I prefer using active record as the store :)

  4. dfg45yfdg Says:
    Sun Feb 05 20:29:10 -0800 2012

    On a related note. It seems the RSpec bundle for TextMate needs how much does an abortion cost updating. The bundle’s spec file generator (shift+control+down_arrow)
    is inserting the spec stub code into the source file instead of the generated spec file.

  5. yacht charter italy Says:
    Fri Feb 17 03:15:26 -0800 2012

    finally I understand where was the issue on my application. Thank you for the update!

  6. project software Says:
    Tue Mar 06 07:06:54 -0800 2012

    I suggest this site to my friends so it could be useful & informative for them also. Thanks!

  7. San Francisco classifieds Says:
    Thu Mar 22 14:23:13 -0700 2012

    I like that this gives us the added bonus of being able to exclude cookie secrets from source control systems. It really makes everything much more simple. Thank you for the heads up.

  8. bestowadeel Says:
    Fri Mar 23 23:50:49 -0700 2012

    I really like the fresh perceptive you did on the issue. Really was not expecting that when I started off studying.Security in Slough | Security in St Albans | Security Companies London | Security in Crawley | Security in St Davids | Car breakers in Birmingham

  9. very irresistible perfume Says:
    Sun Apr 01 09:50:00 -0700 2012

    I didn’t use cookies as well, because it’s making my system slow down considerably, but I am thinking to enable it back, maybe it help the overall progress.

Leave a Reply