Migrating sessions from cookie_store to Redis in Rails 3

Question

I need to switch the session store in my Rails 3 app from cookie_store to redis-session-store. There are many reasons for this (security, SSO with other Rails and non-Rails apps). Are there any best practices on how to do it without loosing all current sessions?

What i could imagine is a two steps approach:

Collect all user sessions for N days and store them in the DB or in Redis (update if already stored).
Use stored user sessions to create entries in Redis.

Alternatively, on the fly migration would also be possible. Means read cookies, use secret key to decrypt the session data and store it as a new session in Redis.

jwg2s jwg2s · Accepted Answer · 2018-09-19T19:33:36

I realize this ticket is pretty old, but this may help others. We ended up changing our session store to Redis, but then still looking for the legacy cookie (for a week or two) before no longer respecting them.

There are probably some security concerns to consider before using this strategy - you want to make sure those risks are worth it compared to the cost of having to sign your entire user-base out all at once. With Rails, the cookies are encrypted and can't be tampered with.

Here's what we used:

class SessionsController < Devise::SessionsController
  LEGACY_COOKIE_NAME = "_old_session_name".freeze

  def new
    return if detect_valid_cookie

    super
  end

  private

  def detect_valid_legacy_cookie
    legacy_cookie = request.cookie_jar.encrypted[LEGACY_COOKIE_NAME].presence || {}
    valid_user_id = legacy_cookie['warden.user.user.key'].try(:first).try(:first)
    return unless valid_user_id

    user = User.find_by(:id => valid_user_id)
    return unless user

    if sign_in user
      request.cookie_jar.delete(LEGACY_COOKIE_NAME)
      redirect_to root_path # or whever you want
      true
    else
      false
    end
  end
end

Migrating sessions from cookie_store to Redis in Rails 3

2 Answers