# Question RE: ActionController::Base.session and ActionController::Base.session\_store

**URL:** <https://discuss.rubyonrails.org/t/question-re-actioncontroller-base-session-and-actioncontroller-base-session-store/54689>\
**Category:** rubyonrails-talk\
**Created:** [September 27, 2010, 7:22pm UTC](https://discuss.rubyonrails.org/t/question-re-actioncontroller-base-session-and-actioncontroller-base-session-store/54689 "2010-09-27T19:22:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![khagimoto](https://avatars.discourse-cdn.com/v4/letter/k/ee59a6/32.png) [@khagimoto](https://discuss.rubyonrails.org/u/khagimoto)\
**Post date:** [September 27, 2010, 7:22pm UTC](https://discuss.rubyonrails.org/t/question-re-actioncontroller-base-session-and-actioncontroller-base-session-store/54689/1 "2010-09-27T19:22:26Z")

</div>

I had been using the cookie-based session until recently, then switched to using active\_record\_store (db) as it said:

# Use the database for sessions instead of the cookie-based default, # which shouldn't be used to store highly confidential information

in the session\_store.rb file.

Everything works fine, but I don't really understand why it's still setting a cookie instead of just using the session db. Is that a normal behavior when using a database for session management?

---

<div class="post-metadata">

**Author:** ![khagimoto](https://avatars.discourse-cdn.com/v4/letter/k/ee59a6/32.png) [@khagimoto](https://discuss.rubyonrails.org/u/khagimoto)\
**Post date:** [September 27, 2010, 7:36pm UTC](https://discuss.rubyonrails.org/t/question-re-actioncontroller-base-session-and-actioncontroller-base-session-store/54689/2 "2010-09-27T19:36:54Z")

</div>

I see the difference now - with the session\_store db instead of the cookie, the cookie is a mere reference to the record in the db. So that makes it more secure than the cookie-based. But I still have a question about the life of the session record in the session db. It doesn't seem to get deleted when the session ends. Is there a method to do that with this class? Thanks!

---

<div class="post-metadata">

**Author:** ![radhames\_brito](https://avatars.discourse-cdn.com/v4/letter/r/8edcca/32.png) [@radhames\_brito](https://discuss.rubyonrails.org/u/radhames_brito)\
**Post date:** [September 27, 2010, 7:54pm UTC](https://discuss.rubyonrails.org/t/question-re-actioncontroller-base-session-and-actioncontroller-base-session-store/54689/3 "2010-09-27T19:54:28Z")

</div>

you are suppose to deleted manually, you can create a rake task and set up a crontab.

---

<div class="post-metadata">

**Author:** ![khagimoto](https://avatars.discourse-cdn.com/v4/letter/k/ee59a6/32.png) [@khagimoto](https://discuss.rubyonrails.org/u/khagimoto)\
**Post date:** [September 27, 2010, 8:25pm UTC](https://discuss.rubyonrails.org/t/question-re-actioncontroller-base-session-and-actioncontroller-base-session-store/54689/4 "2010-09-27T20:25:23Z")

</div>

thanks, radhames brito. I was hoping it was done automagically somehow.. , but found a good reference.. 🙂[http://translated.by/you/rails-in-a-nutshell-chapter-2-action-controller/original/?page=2](http://translated.by/you/rails-in-a-nutshell-chapter-2-action-controller/original/?page=2)