Class: Merb::CookieSession

Class | Merb::CookieSession
In: | lib/merb-core/dispatch/session/cookie.rb
Parent: | SessionContainer

If you have more than 4K of session data or don‘t want your data to be visible to the user, pick another session store.

CookieOverflow is raised if you attempt to store more than 4K of data. TamperedWithCookie is raised if the data integrity check fails.

A message digest is included with the cookie to ensure data integrity: a user cannot alter session data without knowing the secret key included in the hash.

To use Cookie Sessions, set in config/merb.yml

     :session_secret_key - your secret digest key
     :session_store - cookie

### Methods

finalize generate new regenerate serialize setup to_cookie unserialize

### Classes and Modules

Class Merb::CookieSession::CookieOverflow
Class Merb::CookieSession::TamperedWithCookie

### Constants

MAX | = | 4096 |  | Cookies can typically store 4096 bytes.
DIGEST | = | OpenSSL::Digest::Digest.new('SHA1')

### Attributes

_original_session_data | [RW] | :api: private

### Public Class methods

generate()

Generates a new session ID and creates a new session.

#### Returns

SessionContainer: | The new session.

:api: private

new(session_id, cookie, secret)

#### Parameters

session_id<String>: | A unique identifier for this session.
cookie<String>: | The raw cookie data.
secret<String>: | A session secret.

#### Raises

ArgumentError: | blank or insufficiently long secret.

:api: private

setup(request)

Set up a new session on request: make it available on request instance.

#### Parameters

request<Merb::Request>: | The Merb::Request that came in from Rack.

#### Returns

SessionContainer: | a SessionContainer. If no sessions were found,

a new SessionContainer will be generated.

:api: private

### Public Instance methods

finalize(request)

Teardown and/or persist the current session.

If @_destroy is true, clear out the session completely, including removal of the session cookie itself.

#### Parameters

request<Merb::Request>: | request object created from Rack environment.

:api: private

regenerate()

Regenerate the session_id.

:api: private

to_cookie()

Create the raw cookie string; includes an HMAC keyed message digest.

#### Returns

String: | Cookie value.

#### Raises

CookieOverflow: | More than 4K of data put into session.

#### Notes

Session data is converted to a Hash first, since a container might choose to marshal it, which would make it persist attributes like ‘needs_new_cookie’, which it shouldn‘t.

:api: private

### Protected Instance methods

serialize()

Serialize current session data as a Hash. Uses Base64 encoding for integrity.

#### Returns

String: | Base64 encoded dump of the session hash.

:api: private

unserialize(data)

Unserialize the raw cookie data to a Hash

#### Returns

Hash: | the session hash Base64 decoded from the data dump.

:api: private

[Validate]