Changeset 6184

Timestamp:

02/21/07 09:17:38 (2 years ago)

Author:

bitsweat

Message:

Introduce a cookie-based session store as the Rails default. Sessions typically contain at most a user_id and flash message; both fit within the 4K cookie size limit. A secure hash is included with the cookie to ensure data integrity (a user cannot alter his user_id without knowing the secret key included in the hash). If you have more than 4K of session data or don't want your data to be visible to the user, pick another session store. Cookie-based sessions are dramatically faster than the alternatives.

Files:

• trunk/actionpack/CHANGELOG (modified) (1 diff)
• trunk/actionpack/lib/action_controller/cgi_process.rb (modified) (2 diffs)
• trunk/actionpack/lib/action_controller/session_management.rb (modified) (1 diff)
• trunk/actionpack/lib/action_controller/session/cookie_store.rb (added)
• trunk/actionpack/test/controller/session (added)
• trunk/actionpack/test/controller/session/cookie_store_test.rb (added)

trunk/actionpack/CHANGELOG

@@ -1 +1 @@
-*SVN*
+
+* Introduce a cookie-based session store as the Rails default. Sessions typically contain at most a user_id and flash message; both fit within the 4K cookie size limit. A secure hash is included with the cookie to ensure data integrity (a user cannot alter his user_id without knowing the secret key included in the hash). If you have more than 4K of session data or don't want your data to be visible to the user, pick another session store. Cookie-based sessions are dramatically faster than the alternatives.  [Jeremy Kemper]
-
-* Added .erb and .builder as preferred aliases to the now deprecated .rhtml and .rxml extensions [Chad Fowler]. This is done to separate the renderer from the mime type. .erb templates are often used to render emails, atom, csv, whatever. So labeling them .rhtml doesn't make too much sense. The same goes for .rxml, which can be used to build everything from HTML to Atom to whatever. .rhtml and .rxml will continue to work until Rails 3.0, though. So this is a slow phasing out. All generators and examples will start using the new aliases, though.

trunk/actionpack/lib/action_controller/cgi_process.rb

@@ -3 +3 @@
-require 'action_controller/cgi_ext/raw_post_data_fix'
-require 'action_controller/cgi_ext/session_performance_fix'
+require 'action_controller/session/cookie_store'
-
-module ActionController #:nodoc:
@@ -37 +38 @@
-
-    DEFAULT_SESSION_OPTIONS = {
-PStore,
-
-
+CookieStore, # store data in cookie
+    # prefix session file names
+              # available to all paths in app
-    } unless const_defined?(:DEFAULT_SESSION_OPTIONS)
-

trunk/actionpack/lib/action_controller/session_management.rb

@@ +1 @@
+require 'action_controller/session/cookie_store'
-require 'action_controller/session/drb_store'
-require 'action_controller/session/mem_cache_store'