Fjan

@Matthew: I've been using the monkey patch I provided in the November 11th post in production for quite some time now and it works great. Just drop it in the co...

Yes, I actually ended up using the monkey patch above that just return the HTML template if no other is available. There are just to many odd headers out there.

@Michael Koziarski "It returns the strings without dangerous characters"

That's not quite true:
json_escape('hi \"now\"') # => 'hi \now\'

This will insert a spu...

@Ravil, you are right, I stand corrected. Would be nice if we can think of a regex that does both checks in one go though.

The patch still sets an illegal cookie domain name on localhost, you could improve it a little bit by checking @host =~ /\w.[a-z]\w/i
this will make sure there ...

Could it be that there is still a cookie on the system from before you set :domain => all? If that's the case then the browser will send both session cookies an...

Just a small clarification on the obscure IE7 bug in case people want to reproduce it: It only happens in combination with Apache which (correctly) filters P3P ...

At the moment Rails saves sessions after every request that access the (lazy loaded) session, even if the session has not changed. This has two problems:

1. Perfo...

I agree that this patch is a good idea but I think we should go one step further and only update the session if it has both been accessed AND been changed, see ...

This patch doe produce a cookie that doesn't conform to specs if the host you are accessing is "localhost" or an IP address. The browsers I tried don't seem to ...