Calling `reset_session` in Rails 4.0.0 does not work on the second subsequent page

Question

I created something in Rails 4.0.0 and I get weird session behavior. I have a login process that writes a value to a session. Its absence is how I determine that the user is not logged in:

def login session[:user_id] = user.id #Then we render a simple page... end 

To make sure that I have a valid user, I have a helper in my application_controller.rb :

 def current_user logger.info "(current_user) Session ID: #{request.session[:user_id]}" if session[:user_id] != nil && session[:user_id] != -1 User.find(session[:user_id]) end end helper_method :current_user 

This is called up from several different places to check the status of the user and decide how to make the page. ( != -1 is explained below.) On logging out, I reset the session:

 def logout reset_session end 

The presented view includes a call to the helper method current_user to render navigation. This page is displayed when my navigation is partially shown, since it does not have the current user, and the debug logs display the session variable as cleared. However, no matter what I do, on the next page it returns to the login state, and I suddenly authenticate the user again, so that current_user gets the correct value from the session.

I tried to assign a different value to the session (for example, -1), and this has the same effect. For some reason, my session is recovering after it is deleted. Also, when I use the following:

 def logout reset_session redirect_to root_path end 

The index page is indicated with a registered user. This is incredibly annoying. I appreciate that I can use Devise, etc., but it's really about the weird behavior of the session.

Things I tried:

• An experiment with rake tmp:sessions:clear has no effect.
• Rewriting session value with something else.
• Checking _my_key cookie value (which never changes?) - Although I get the given values ​​returned in response headers with a different value ...? This seems a little strange.
• Turbo Links deleted.
• Using Rails 4.0.0 and Ruby 2.0.0 p247
• Chrome and Safari ...

I am completely shocked by this. Oh, and as the final kicker, if I delete the session cookie in the browser, the session recording also failed. Therefore, I will never come back.

Update

Here are the logs to enter. I deleted the cookie in my browser, and instead of not logging out, I cannot log in:

 Started GET "/auth/google_oauth2/callbackstate=***************************&code=***********************************" for 127.0.0.1 at 2013-08-26 18:59:15 +0100 I, [2013-08-26T18:59:15.307731 #7441] INFO -- omniauth: (google_oauth2) Callback phase initiated. Processing by UsersController#callback as HTML Parameters: {"state"=>"*************************", "code"=>"****************************"} User Load (0.9ms) SELECT "users".* FROM "users" WHERE "users"."uid" = '************************' LIMIT 1 (current_user) Session ID: 1 Setting user_id in session: 1 => [1] Account Load (2.4ms) SELECT "accounts".* FROM "accounts" WHERE "accounts"."id" = $1 ORDER BY "accounts"."id" ASC LIMIT 1 [["id", 1]] Redirected to http://127.0.0.1:3000/pages Completed 302 Found in 103ms (ActiveRecord: 7.3ms) Started GET "/Pages" for 127.0.0.1 at 2013-08-26 18:59:16 +0100 Processing by PagesController#index as HTML (current_user) Session ID: Rendered public/401.html (1.0ms) Filter chain halted as :is_authenticated rendered or redirected Completed 401 Unauthorized in 11ms (Views: 10.8ms | ActiveRecord: 0.0ms) 

You can see two lines marked (current user) , which are calls to my helper method (as indicated above). I get data from Google OAuth using OmniAuth, but this is not particularly relevant. (AFAIK ...)

Answer 1

Pancake. I tried to make this application multiple tenants, and in my session_store.rb :

was the following:

 # Be sure to restart your server when you modify this file. MyApp::Application.config.session_store :cookie_store, key: '_MyApp_session' #writes cookies across all subdomain of this site. Rails.application.config.session_store :cookie_store, :key => '_my_key', :domain => ENV['APP_DOMAIN'] 

This seems to be bad, and all sorts of crazy things happen to your cookies and sessions. The key should be in _my_key , which I consider non-standard? I suppose I got this from another SO question, without fully realizing the consequences.