Question

  def create
    user = User.find_by_email(params[:email])

    if user && user.authenticate(params[:password])
      session[:foo] = "bar"
      session[:user_id] = user.id
      redirect_to root_url, notice: "Signed in!"
    else
      flash.now[:error] = "Email or password is invalid."
      render "new"
    end
  end

When I decode the base64 cookie, I get:

{I"session_id:EFI"%14cd484a34917f7d923ef8222c16e0e1;TI"foo;FI"bar;FI"_csrf_token;FI"1ajWlOZok1Amp8Nh9uOdUWzeM20b873zocEbyiR+b1ao=;FI"user_id;Fi }

How come the my session[:foo] is set but not my session[:user_id] ?

Answer 1

Looks to me that it is set, but the value of user_id is such that it’s Marshal.dump output (which is what a cookie stores) is a non printable or whitespace character. If you’re interested in why only user_id is affected in this way you’d have to look into the details of the marshal format (which doesn’t appear to be widely documented). I’d guess that with integers ruby basically spits out the byte value(s), which will often result in unprintables.

I don’t know how you’re doing that base64 decode, but if you do it in a ruby console then the default output of inspect does show non printable characters