Session IDs and SWFUpload

Hi

I’m using SWFUpload in one of my applications, but it has one big shortcoming: it doesn’t maintain the session. Let me explain:

The user has to login to the application, thus creating an authenticated session (cookie _session_id client side and the sessions table server side). However, when you use SWFUpload, the upload script is called with a new session (unauthenticated), making the app assume the new session has no access and redirects it to the login page.

Currently, I’ve just exposed the upload methods, so that they don’t require authentication. However, this is like locking your front door, but leaving the back door wide open.

Apparently, the only way for a Flash file to pass on parameters, is using GET. I can append the _session_id cookie value to the upload URL, but I can’t seem to get Rails to use this _session_id value (params[:_session_id] instead of the one passed in the HTTP headers.

Is it somehow possible to override the HTTP header cookie _session_id in favor of one that is passed as a GET parameter, but only for the upload_file method, so that the authenticated state is still recognized?

Best regards

Peter De Berdt

Never heard of SWF upload. Why not use acts_as_attachment instead? Widely used, nicely tested and written by a rails core dev.

http://svn.techno-weenie.net/projects/plugins/acts_as_attachment/

They are not comparable. SWFupload is a flash file-upload widget with lots of features, see

   http://labb.dev.mammon.se/swfupload/

-- fxn

From: rubyonrails-talk@googlegroups.com [mailto:rubyonrails- talk@googlegroups.com] On Behalf Of Xavier Noria Sent: 21 January 2007 00:03 To: rubyonrails-talk@googlegroups.com Subject: [Rails] Re: Session IDs and SWFUpload

> > Never heard of SWF upload. Why not use acts_as_attachment instead? > Widely used, nicely tested and written by a rails core dev. > > http://svn.techno-weenie.net/projects/plugins/acts_as_attachment/

They are not comparable. SWFupload is a flash file-upload widget with lots of features, see

   http://labb.dev.mammon.se/swfupload/

-- fxn

I came across the same problem recently and this solved it nicely:

d/

hth

This is just great, a big thanks to you Richand and to Duane!

Best regards

Peter De Berdt