Hobo Hobo → Hobo 1.3 (Rails 3)

Comments and changes to this ticket

• 

  Matt Jones April 11th, 2010 @ 10:27 PM

  Note that this is a design issue inherited from restful_authentication; it could also be regarded as a "feature" in some implementations (multiple apps on the same domain authenticating against a single user database).

  Not sure if this is related or not:
  http://nessence.net/2009/10/26/restful-authentication-subdomain-fu-...

  Note that the above link is specifically trying to get the opposite effect, persisting a single :auth_token across multiple subdomains.

• 

  Bryan Larsen April 12th, 2010 @ 09:14 PM

  Matt, are you comfortable with this patch? It doesn't seem unreasonable to me.

• 

  Matt Jones April 12th, 2010 @ 09:55 PM

  It seems fairly reasonable to me, but I'm still not convinced it's a correct solution to Henry's issue. If I'm reading his description correctly, what he's really looking for is the 'Path' attribute for cookies, to segment cookies from http://example.com/app_one/ vs. http://example.com/app_two/. I was shocked to discover there is not (AFAIK) any simple way to do this in Rails - I expected a config option of some sort to set the default :path value for cookies set via cookie[:foo] = bar.

  @Henry: I'm guessing that you're setting config.action_controller.relative_url_root for each app? Maybe we could add an option to add a :path option to the cookie? Or maybe this monkey-patch would help:

    class ActionController::CookieJar
      def []=(key, options)
        if options.is_a?(Hash)
          options.symbolize_keys!
        else
          options = { :value => options }
        end
  
        options[:path] = ActionController::Base.relative_url_root || "/" unless options.has_key?(:path)
        super(key.to_s, options[:value])
        @controller.response.set_cookie(key, options)
      end
  
      # Removes the cookie on the client machine by setting the value to an empty string
      # and setting its expiration date into the past. Like <tt>[]=</tt>, you can pass in
      # an options hash to delete cookies with extra data such as a <tt>:path</tt>.
      def delete(key, options = {})
        options.symbolize_keys!
        options[:path] = ActionController::Base.relative_url_root || "/" unless options.has_key?(:path)
        value = super(key.to_s)
        @controller.response.delete_cookie(key, options)
        value
      end
    end
  

  (drop in an initializer; this could be shorter, but alias_method_chaining a []= method is messy. Should work, but not tested.)

  In any case, the existing behavior can be useful - several apps mounted on the same host with a common user table would be a standard use case. Whatever resolution we come up with, it should be switchable.

• 

  Matt Jones September 14th, 2011 @ 10:22 PM

  • State changed from “new” to “open”
  • Milestone set to “Hobo 1.3 (Rails 3)”
  • Milestone order changed from “0” to “0”