On Cross Subdomain Cookies
July 12, 2011 § 1 Comment
The first Ruby gem I ever wrote was tld-cookies. While it is very poorly named, probably should have been called root-domain-cookies
or something like that, it adds a nice little bit of functionality to the Rails 3 cookie jars.
One of the things about Rails 3 that I thought was really cool, was the way cookies were accessed. It’s not a big and fancy piece of code, but to me it is just a slick way to do things. The chaining of the different cookie jars makes it trivial to create the cookies you want and need.
cookies.permanent.signed[:awesome_cookie] = "cookies awesomeness" cookies.signed[:awesome_cookie] => "cookies awesomeness"
At the time I was working on a project at work that required the use of a lot of dynamic subdomains, and we wanted to be able to write cookies across all of the subdomains as well as for individual subdomains. In Rails 3 you could set the domain when you write to the cookie like:
cookies.signed[:awesome_cookie] = { :value => "cookies awesomeness", :domain => "example.com" } cookies.signed[:awesome_cookie_sub] = { :value => "cookies awesomeness subdomain", :domain => "sub.example.com" }
Now that is a lot of extra work and looks pretty ugly. You could set the default domain for you cookies like this:
Rails.application.config.session_store :cookie_store, :key => '_app_name_session', :domain => :all
But I guess I’d rather explicitly say when a cookie is to be used across all subdomains. To this point I tld-cookies
add a tld
cookie jar to your Rails 3 app which sets the domain for the cookie to be the root domain, i.e. example.com.
cookies.tld.signed[:tld_cookie] = "ACROSS ALL SUBDOMAINS!!!" cookies.signed[:tld_cookie] => "ACROSS ALL SUBDOMAINS!!!"
As you can see above, you use it similarly to how you would use the permanent
cookie jar. The slight difference is when you want to delete the cookie you have to use the tld
accessor.
So yeah, first Ruby gem. Poorly named, fun little learning project.
On Encrypted Cookie Sessions
June 16, 2011 § 1 Comment
Once I had finished up with the encrypted-cookie gem, it seemed like a natural extension to convert it into a Rails 3 session store. It operates just like the basic cookie session store, just using an encrypted cookie instead of a signed cookie. It uses the encrypted-cookie
gem, so all the encryption is provided by ActiveSupport::MessageEncryptor. To start using it add the following to your Gemfile:
gem 'encrypted-cookie-store'
And change your session store in config/initializers/session_store.rb
AppName::Application.config.session_store :encrypted_cookie_store, :key => '_app_name_session'
The dependencies will include the encrypted-cookie
gem for you. Accessing the session is the same as always:
session[:tid_bit] = "of information" session[:tid_bit] # => "of information"
You can check out the source over on github.
Currently this only works with Rails 3.0.*. All of the session code got switched up for Rails 3.1, so it’s going to take some extra work to get it working for the new release of Rails. Update June 18: Got it working with Rails 3.1. Yay conditional method definitions!!! Sigh…