Ruby on Rails 4 Session Cookie

HTTP is a stateless protocol. Sessions make it “stateful”. Session data can be stored on the client side or server side.

Client Side

Rails 4 default session storage is CookieStore. All session data is stored on the client side. There is a 4kb limit.

Server Side

Session data is stored on the server side. The corresponding session id would be stored in a cookie on the client side.

 

Session Store Options

ActionDispatch::Session::CookieStore – Stores everything on the client.
ActionDispatch::Session::CacheStore – Stores the data in the Rails cache.
ActionDispatch::Session::ActiveRecordStore – Stores the data in a database using Active Record. (require activerecord-session_store gem).
ActionDispatch::Session::MemCacheStore – Stores the data in a memcached cluster (this is a legacy implementation; consider using CacheStore instead).

Some Tips for Working With Sessions

Firebug – There is a very useful cookie inspector.

In Rails, if you use pry in a controller, you can enter session.to_hash to inspect the session. Alternatively, you could use <%= debug session.to_hash %> in the view to inspect the session.

You can set session data with session[:foo] = "bar".

If you want to see the code responsible for encryption. Do bundle open activesupport and find message_encryptor.rb. bundle open actionpack and find cookies.rb.

Sources

http://pothibo.com/2013/09/sessions-and-cookies-in-ruby-on-rails/

http://guides.rubyonrails.org/security.html#sessions

http://machinesaredigging.com/2013/10/29/how-does-a-web-session-work/

http://railscasts.com/episodes/84-cookie-based-session-store?view=comments

http://guides.rubyonrails.org/action_controller_overview.html#session