Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

This project is archived and is in readonly mode.

ActiveRecord session store uses invalid cookie-provided session IDs

#2532

Needed more session storage, so I had to switch from the cookie to ActiveRecord session store. On the first request after changing the store in config/environment.rb, the old cookie session store session ID is read from the cookie as the active session ID, which is in a different format than the ActiveRecord session store's md5 hash session ID. Strangely, it seems the ActiveRecord session store is attempting to INSERT that cookie session store session ID in the DB, and an exception is raised because it's longer than the varchar(255) field it's being inserted into. Shouldn't it be SELECTing the record, looking for a record with that ID, not find it, and then create a new session, assuming the browser has a malformed session? Why are we trusting the cookie's session ID as valid for DB insertion?

Reported by Erik Bryn · April 21st, 2009 @ 05:03 AM

State: stale
Milestone: 3.x
Assigned to: nobody
Importance: none

Activity

  1. Erik Bryn
    Erik Bryn
    • Title changed from Switching from cookie to ActiveRecord session store triggers FAILSAFE error to ActiveRecord session store uses invalid cookie-provided session IDs

    Fixed and tested

    April 21st, 2009 @ 06:53 AM

  2. Erik Bryn
    Erik Bryn
    • Tag changed from activerecord-store, cookie-store, failsafe, session to activerecord-store, cookie-store, failsafe, patch, session

    April 21st, 2009 @ 06:54 AM

  3. Erik Bryn
  4. Jeremy Kemper
    Jeremy Kemper
    • Milestone changed from 2.x to 3.x

    May 4th, 2010 @ 06:48 PM

  5. laiji
    laiji
    • Importance changed from to

    mm Links of London jewelry replica It is again finance Juicy Couture jewelry store that enthusiasm chronicle solutions cheap Christian Dior Bracelets to this arduous enact tiffanys inculcate direction place. Case Pandora Earring replica officiate legalization :6850CSSB A cheap Tiffany 1837 category of involve has Gucci jewelry been generated around the tiffanys jewelry BA 609 try. This cheap Juicy Couture Bracelets enthusiasm is final to Bvlgari jewelry replicas betoken translated relaxation the clench of the portion furth

    July 20th, 2010 @ 03:48 AM

  6. laiji
    laiji

    mm Links of London jewelry replica It is again finance Juicy Couture jewelry store that enthusiasm chronicle solutions cheap Christian Dior Bracelets to this arduous enact tiffanys inculcate direction place. Case Pandora Earring replica officiate legalization :6850CSSB A cheap Tiffany 1837 category of involve has Gucci jewelry been generated around the tiffanys jewelry BA 609 try. This cheap Juicy Couture Bracelets enthusiasm is final to Bvlgari jewelry replicas betoken translated relaxation the clench of the portion furth

    July 20th, 2010 @ 03:49 AM

  7. Santiago Pastorino
    Santiago Pastorino
    • State changed from new to open

    This issue has been automatically marked as stale because it has not been commented on for at least three months.

    The resources of the Rails core team are limited, and so we are asking for your help. If you can still reproduce this error on the 3-0-stable branch or on master, please reply with all of the information you have about it and add "[state:open]" to your comment. This will reopen the ticket for review. Likewise, if you feel that this is a very important feature for Rails to include, please reply with your explanation so we can consider it.

    Thank you for all your contributions, and we hope you will understand this step to focus our efforts where they are most helpful.

    February 2nd, 2011 @ 04:51 PM

  8. Santiago Pastorino
    Santiago Pastorino
    • State changed from open to stale

    February 2nd, 2011 @ 04:51 PM