0

I have a Rails 6.1 application that previously used to serve assets from /assets (asset_host was unset)

Recently I've changed the asset_host to use //assets<X>.example.com/ where X would be a random number between 1 and 10.

  config.action_controller.asset_host = Proc.new { |source, request|
      request.nil? ? "" : "//assets#{rand(1..10)}.#{request.domain}/"
  }

My session store configuration is set to ActiveRecord

Rails.application.config.session_store :active_record_store, :key => '_app_session', :expire_after => 7.days

Now I see that each hit to one of these subdomains gets a different cookie set which basically means Rails is starting a session for each asset host, which is bad (sessions table at 2M at this point).

Since I'm using Passenger with Apache I have also set it up to serve assets on the web server rather than going through Passenger:

<Location "^/assets/.+$">
    PassengerEnabled Off
</Location>

... apparently this is not working since the cookies do get set.

In fact I'm not even able to see where the asset cookies get set because none of the asset responses contain Set-cookie headers (tried 3 browsers, cleared caches, tried incognito, tried different computers)

Why and how is this sorcery happening and how do I get it to use the same cookie set for the main subdomain www.example.com or root example.com without hardcoding the domain name (it's a multi-tenant app serving multiple domains)?

Improve this question
5
  • 1
    Add :domain => :all, :tld_length => 2 to the session store configuration and you should be set Commented Oct 24 at 21:54
  • Hi @dbugger, thank you, you're right it is a great idea. Will it work with domain names like example.co.uk or elpmaxe.com.au? Commented Oct 25 at 9:21
  • 1
    Tweak the tld_length as needed Commented Oct 26 at 15:08
  • Doesn't seem to take a proc github.com/rails/rails/blob/main/actionpack/lib/action_dispatch/… but looking at that code - it might be easier not including tld_length, what do you think? Commented Oct 27 at 17:09
  • you have the code in front of you -- does it work? And why would you need a proc? Commented Oct 27 at 17:47
Related questions
1251
Getting error: Peer authentication failed for user "postgres", when trying to get pgsql working with rails
19
IE10 sharing cookies across subdomains by default
1
How to set cookie independently for each subdomain, causing different cookies?
Load 6 more related questions Show fewer related questions

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.