All geek questions in one place

Devise - how does it set session cookies?

I have a scenario where I do NOT need to establish a session using the HTTP protocol, but only install it on HTTPS pages. The problem at the moment is that we are passing a session string between HTTPS and HTTP.

those. if you visit our HTTP page, you are assigned a session string (unsecured). When you visit one of our HTTPS pages, it uses the same session line. They are shared between both. We do not want people to be able to track the session string over unencrypted connections.

Can someone point me to reading, or doco around, how could I achieve something like this? Even WHERE to see - I'm a bit stumped. Can't find a lot.

+4
source share
2 answers

The rails session data is stored in cookies by default, does it look like you want to use SSL cookies only?

UPDATED: try adding secure: true to your config/initializers/session_store.rb file, i.e.

 secure_option = (Rails.env.development? || Rails.env.test?) ? false : true YourApp::Application.config.session_store :cookie_store, { key: '_xxxx_session', secure: secure_option }

When creating Devise cookies, use the rail settings.

original answer

in your config/initializers/devise.rb should be a line that looks like this:

  # :secure => true in order to force SSL only cookies.

try adding to config.rememberable_options and restarting the rails - NOTE: in development mode you don't need, you can do

 secure_option = (Rails.env.development? || Rails.env.test?) ? false : true config.rememberable_options = { :secure => secure_option }

see also:

+8
source

If you want to change the session cookie, you will have to change them in the callback of the boss, see this thread and this blog post

Alternatively, you can use a separate cookie . RailsCast is here .

0
source

Source: https://habr.com/ru/post/1487973/

More articles:


All Articles