reset_session Doesn't Result In New Session Id Being Applied Via Set-Cookie

Yes, I'm currently running the very latest commit. I'm also in the process of working on cookie_store_test trying to recreate the bug. I'm hopeful I can get a patch together yet tonite. Shouldn't be a problem once I can create the failing test.

I had a little more time to investigate this. I wasn't able to create a test to recreate the behavior I'm seeing. I was able to debug it a bit more. I can get the proper behavior of:

Set-Cookie: session_key=1221362112abcd..

after a reset_session if I place something in the session after the call to reset_session. I thought it was the equals check of:

unless original_session == env[ENV_SESSION_KEY]

in cookie_store/activerecord_store but when I force this to fail and generate the cookie each time, the problem didn't go away. I'm not sure where else the cookie header is set.

I do know reset_session only works only if you place something in the new session.

Ah, it doesn't want to write an empty session.

There are a few behaviors we want to preserve as well:

• Don't load or write a new session if the session hash is never accessed (lazy loading)
• Don't write the session cookie if it is the same as the original
• For DB stores, don't write the session object back to memcache or AR if the session has not changed
• Only write an empty session if the session existed at the beginning of the session, but now is empty. You deleted all the keys or you called reset_session

Cool, I think this is on the right track but we can't assume @env['rack.session'] will respond to reset!. This should work with other Rack stores as well.

Could we just check?

if env[ENV_SESSION_KEY].loaded? && env[ENV_SESSION_KEY] != original_value

Updated

Looks like this will work, patching right now.

if !session_data.is_a?(AbstractStore::SessionHash) || session_data.send(:loaded?)

doesn't work for me. in mongrel works after adding

session[:is_new] = true

but in passenger still restores old session.

solved by

headers['Set-Cookie'] = ''

after reset_session call

reset_session seems to be working perfectly for me using mongrel as well. In passenger though, I can't seem to logout of my site. I used git bisect and I'm able to logout perfectly fine in Passenger up until this commit:

http://github.com/rails/rails/co...

I haven't yet determined what it is in that commit (or if it's something that Passenger needs to update or has already updated.) I'm using 2.06 of passenger which I think is the latest.

Confirmed. Yury's fix works

This seems to be a bug with Passenger: reset_session fails only with Passenger 2.0.6, not with Mongrel. Upgrading to edge Passenger solves the issue for me

I think this is the same (or related) issue as cookie_store session object not being serialized if it is only written, not read in a request. This is the behaviour with Phusion 2.0.6.

The cookie is serialized properly in Mongrel with the same code.

As a workaround I add a before filter to the app to access the session object, which appears to then result in the correct serialization with Phusion.

This is on current edge rails.

Hmm, i was incorrect. Adding the before_filter to access the session does not work around the Phusion issue.

Is this flying under the radar because it's marked as resolved? I'm having the same issues as everybody above on rails 2.3.1. I'm still poking around so I don't have anything of value to add.

Pre 2.1 "Passengers" are not compatible with Rails 2.3.x.

See: http://blog.phusion.nl/2009/03/0...

"What’s new in 2.1.1? Support for Rails 2.3"