Question RE: ActionController::Base.session and ActionController::Base.session_store

rubyonrails-talk
1

I had been using the cookie-based session until recently, then switched to using active_record_store (db) as it said:

# Use the database for sessions instead of the cookie-based default, # which shouldn't be used to store highly confidential information

in the session_store.rb file.

Everything works fine, but I don't really understand why it's still setting a cookie instead of just using the session db. Is that a normal behavior when using a database for session management?

2

I see the difference now - with the session_store db instead of the cookie, the cookie is a mere reference to the record in the db. So that makes it more secure than the cookie-based. But I still have a question about the life of the session record in the session db. It doesn't seem to get deleted when the session ends. Is there a method to do that with this class? Thanks!

3

you are suppose to deleted manually, you can create a rake task and set up a crontab.

4

thanks, radhames brito. I was hoping it was done automagically somehow.. , but found a good reference.. :slight_smile: http://translated.by/you/rails-in-a-nutshell-chapter-2-action-controller/original/?page=2