Prevent Sending Ruby on Rails Session Header

Question

How to prevent Rails from always sending a session header (Set-Cookie). This is a security issue if the application also sends the Cache-Control: public header.

My application affects (but does not modify) the session hash in some / most actions. Closed content is not displayed on these pages, so I want them to be cachable, but Rails always sends the cookie header, regardless of whether the previous hash is different from the previous one or not.

I want to achieve only sending a hash if it is different from the one received from the client. How can you do this? And probably this fix should also be part of the official Rails release? What do you think?

Answer 1

Rails only adds session cookie data to the Set-Cookie header if it has been affected. Perhaps you are setting things to the values ​​that they already contain - they are not intelligent enough to check if the data is really different.

to change . My answer is a bit misleading. When you use the cookie session store, a new cookie is set if the cookie value (after Marshaling) changes.

Cm. actionpack/lib/action_controller/session/cookie_store.rb

Answer 2

For Rails 3 use this.

env['rack.session.options'][:skip] = true

or equivalent

request.session_options[:skip] = true

Here you can find the documentation http://doc.rubyists.com/rack/Rack/Session/Abstract/ID.html

Answer 3

:

config.action_controller.session_store = :nil_session_store

. .