Change Rails session cookie domain without logging users out -
i'm using rails 4.2.2 (with devise 3.4.1) , changing cookie_store domain www.boundless.dev .boundless.dev in order share same session across of our subdomains (single sign-on).
boundless::application.config.session_store :cookie_store, key: '_boundless_session', domain: '.boundless.dev'
if make change alone. existing logged-in users return site end 2 _boundless_session
cookies, 1 domain boundless.dev , other www.boundless.dev. somehow makes logging out impossible.
is possible make change without logging users out of site?
i thought i'd able write method before_filter
in applicationcontroller delete session cookie , replace new 1 @ .boundless.dev, doesn't work, , suspect has remember_user_token
cookie.
def update_session_cookie_domain session_cookie = cookies['_boundless_session'] cookies.delete('_boundless_session', domain: 'www.boundless.dev') cookies['_boundless_session'] = { value: session_cookie, domain: '.boundless.dev' } end
i able solve problem changing cookie name used session.
so original config was:
boundless::application.config.session_store :cookie_store, key: '_boundless_session', domain: 'www.boundless.dev'
and changed to:
boundless::application.config.session_store :cookie_store, key: '_boundless_session_new', domain: '.boundless.dev'
i expected log users out, doesn't reason don't quite understand.
unfortunately, i've yet find way clear old _boundless_session
cookie, @ least can log out after having session cookie updated more general domain.
Comments
Post a Comment