I am trying to set up a simple subdomain-based blog in rails 3.2.8. Basically it will have sites, users (authenticated through Devise), and memberships to connect users to sites. I set up POW so that myapp.dev is working properly. Each site has a subdomain and I can navigate to the site#show action using the subdomains with no problems. My issue is that I can't get the Devise sessions to be shared across subdomains. Everything is working fine on my heroku app, but I would like to be able to test this locally.
When I add the following to session_store.rb, teh sessions seem to work across subdomains, but then I can't log out.
Appname::Application.config.session_store :cookie_store, :key => '_appname_session', domain: :all
When I change the end to domain: ".appname.dev" it doesn't work.
Any help would be greatly appreciated!
Make sure you clear your cookies and restart the app.
Appname::Application.config.session_store :cookie_store, :key => '_appname_session', domain: ".appname.dev"
domain: ".appname.dev" is the correct format for the domain option. The beginning period is important.
Related
I have the domain ingledow.co.uk. I have recently been working on a Heroku app that is deployed to david.ingledow.uk and this has been done successfully.
However, I now want to redirect all my old domain and subdomains to david.ingledow.co.uk. Here is a list of domains I have that I want to redirect to my new subdomain:
ingledow.co.uk > david.ingledow.co.uk
www.ingledow.co.uk > david.ingledow.co.uk
blog.ingledow.co.uk > david.ingledow.co.uk
I've set CNAMEs to david.ingledow.co.uk. but I get the following error:
Heroku | No such app
There is no app configured at that hostname.
Perhaps the app owner has renamed it, or you mistyped the URL.
Any suggestions would be much appreciated!
If you're setting them as CNAME's then they are not redirects - it would be making your site available on www.ingledow.co.uk, blog.ingledow.co.uk. You'd have to add these all as custom domains to your application and then handle the redirect in your app. Instead you could set them up as redirects so when you go to blog.ingledow.co.uk you get redirected to david.ingledow.co.uk at DNS level.
See https://devcenter.heroku.com/articles/route-53#naked-root-domain for more info.
I have seen a lot of questions about this topic, but a lot of them have contradictory information, and for some reason it didnt work for me.
I have:
a top level domain: i.e. lvh.me (development).
each user has subdomains: i.e. userdomain.lvh.me
The login form is in the top level domain: lvh.me
I want:
If an user logs in, the session needs to be shared between all the subdomains. I mean, the session needs to be active in lvh.me:3000/something and userdomain.lvh.me:3000
If an user logs out from lvh.me:3000/something it should work, and if the user logs out from userdomain.lvh.me:3000 it should work also.
I tried
Setting in an initializer the following:
MyApplication::Application.config.session_store :cookie_store, :key => '_mykey', :domain => :all
What happened?
I can login in lvh.me:3000, I am correctly redirected to lvh.me:3000/internalpage and if I go to subdomain.lvh.me:3000 it works great. I can also logout from lvh.me:3000/internalpage BUT if I try to logout from subdomain.lvh.me:3000 it doesn't work. The destroy action in Devise SessionsController is executed and everything, but the session doesn't die.
According to http://excid3.com/blog/sharing-a-devise-user-session-across-subdomains-with-rails-3/,
The trick here is the :domain option. What this does is sets the level
of the TLD (top level domain) and tells Rails how long the domain is.
The part you want to watch out for here is that if you set :domain =>
:all like is recommend in some places, it simply won’t work unless
you’re using localhost. :all defaults to a TLD length of 1, which
means if you’re testing with Pow (myapp.dev) it won’t work either
because that is a TLD of length 2.
So, after reading that I also tried
MyApplication::Application.config.session_store :cookie_store, :key => '_mykey', :domain => 'lvh.me'
What happened?
I can login in lvh.me:3000, I am correctly redirected to lvh.me:3000/internalpage and if I go to subdomain.lvh.me:3000 it doesn't work, i have no session there. If I go back to lvh.me:3000/internalpage my session has disappeared. What happened there?
What else?
Then, after reading rails 3.2 subdomains and devise I changed my initializer line to
MyApplication::Application.config.session_store :cookie_store, :key => '_mykey', :domain => '.lvh.me'
Note the "." before the domain name.
According to the post in SO:
This allows this cookie to be accessible across subdomains and the
application should maintain it's session across subdomains. May not be
100% what you are looking for but it should get you going in the right
direction.
What happened?
Nothing, it didn't work. Same behavior if compared with the last thing I tried.
I finally tried What does Rails 3 session_store domain :all really do? , creating a custom class to handle the cookies. But I had no luck.
Of course that I deleted all the cookies and temp files before each attempt. Also I changed the name of the cookie.
Any help? Thanks!
According to this guy here: Rails: how can I share permanent cookies across multiple subdomains? You need to set the domain manually? Googling around it looks like '.domainname.com' with the dot at the beginning really is the way to go.
If you inherit from Devise::SessionsController you can manually set it on create
class SessionsController < Devise::SessionsController
def create
# modify the cookie here
super
end
end
I am setting up a working example to test that out, I'll post back afterwards, cheers!
And here is my Edit
Forget tempering with the token on create. The problematic is this, you need to have the token domain set to '.lvh.me' that's all there is to it, but domain: '.lvh.me' just doesn't do anything. Here is my proof of concept and ultimately it boiled down to a single change inside a controller:
class HomeController < ApplicationController
def index
cookies[:_cookietest_session] = {domain: '.lvh.me'}
end
end
In Chrome the token would look like this
And that for subdomain.lvh.me, lvh.me and any other subdomain I tried. I can sign_in/sign_out from any and the session is created/destroyed accordingly.
Now I wouldn't advise doing it the way I did, I liked the middleware approach I think it would work just fine if setup properly. Let me know if you need further help on this.
Cheers!
Ok last thing
I went back and tried domain: :all because it really ought to work as you have expected. If I access lvh.me I get a cookie with .lvh.me but if I got to subdomain.lvh.me I get one that reads .subdomain.lvh.me
I think the issue is that :all adds a . to the subdomain.lvh.me so you would stay logged in with foo.subdomain.lvh.me which doesn't do you much good.
:all seems to work if your original login is from the root domain lvh.me and you then redirect to a subdomain. but you can't log in through a subdomain with it set that way.
MyApplication::Application.config.session_store :cookie_store, :key => '_mykey', :domain => '.lvh.me'
looks like the correct way to specify this.
Note:
Make sure you restart rails after making change.
Make sure you clear cookies out for your domain before testing again. You can leave remnant cookies behind that are confusing between tests.
I've successfully troubleshooted an issue with session members not being available even though they were set and would like to know why it's happening. My situation can be described as:
Sinatra app using :session.
Using oAuth to authorise users and in the process setting a :ret_url session member so that the app knows where to come back to after auth.
Server is unicorn on Cedar stack (Heroku)
This works perfectly whilst running locally but the :ret_url session member was completely disappearing from the session on Heroku. I found that if I removed this code it fixed the problem:
before do
cache_control :public, :must_revalidate, :max_age => 60
end
Question 1: I'm guessing that my cookie was being cached without the :ret_url value and that's why it was breaking?
Question 2: I was setting the session member as shown in the route condition code below, is this the wrong place to do it?
# redirect users to login if necessary
set(:auth) do |access_token|
condition do
if request.request_method == 'GET'
session[:ret_url] = request.path_info
end
redirect '/' unless user_logged_in?
end
end
I'd like to use cacheing and still have my cookie be valid.
Hard to see what is going on without knowing all details, but there is a simple rule that you are most probably violating: do not use http caching on actions that are supposed to do something (other than just show page). When http caching is on, you browser does not even try to re-load the page and renders it from browser cache.
Cookies are not cached anywhere, the only thing cache_control does is setting CacheControl http response value
In your case the best thing you can do is to add list of routes that have no-action pages to your before block:
before '/my/static/page' do
cache_control :public, :must_revalidate, :max_age => 60
end
Most probably you will have very limited set of routes where you can benefit from http caching
A chap by the name of Ari Brown (waves at Ari), who is not a member here but deserves the credit for this answer, pointed me at the right solution, which is, as per the Sinatra FAQ, to not use enable :sessions but to use Rack::Session::Cookie as per
use Rack::Session::Cookie, :key => 'rack.session',
:domain => 'foo.com',
:path => '/',
:expire_after => 2592000, # In seconds
:secret => 'change_me'
I've added this into my config.ru and all is well.
I also noticed over in this post the alternative suggestion to set :session_secret, 'change_me' and, indeed, to do this via an environment variable, namely:
$ heroku config:add SESSION_KEY=a_longish_secret_key
then in your app
enable :sessions
set :session_secret, ENV['SESSION_KEY'] || 'change_me'
Obviously you can use the environment variable strategy with the Rack::Session::Cookie approach too. That's the way I went as it offers more flexibility in configuration.
The reason these work is that the cache controller middleware is farming requests out to multiple server instances and without setting a session secret it's just making one up per server, and thus breaking the sessions.
I want to set default cookie domain for my application to ".mydomain.com" to allow cookie session be preserved across subdomains. There are many places showing how to do it in Rails 2.x but these solutions doesn't work for Rails3. Anyone know how can I set it?
I've found the solution. Here it is:
Rails.configuration.session_store :cookie_store, {
:key => '_your_app_session',
:domain => ".domain.com"
}
This should go into config/initializers/session_store.rb. Works great for me.
Has anyone got RadiantCMS with multi_site working on Heroku? I actually tried it and it bombed big-time giving the error:
Heroku | No such app
There is no app configured at that hostname.
Perhaps the app owner has renamed it, or you mistyped the URL.
This is what I tried:
Go to tractor.heroku.com and login using admin / radiant.
If you see the 'Sites' section, you will find Foo and Bar sites.
I edited my /etc/hosts files and added foo.myapp.com and bar.myapp.com to the IP address that resolves to tractor.heroku.com (Not entirely sure if this is right)
Now type the URL "http://foo.myapp.com" in the browser and it gives me the above error.
Is there some special configuration required to get this working on Heroku?
So, I finally did get an answer from heroku support themselves. Pasting it here for everyone's benefit:
reception said:
fyi if you want a 301 redirect from appname.heroku.com url to yourdomain.tld i succeeded with this steps:
freeze radiant (in order to be able to modify application_controller.rb; see http://wiki.github.com/radiant/radiant/running-on-edge )
add this code to application_controller.rb inside class ApplicationController:
---->8
before_filter :redirect_domain
def redirect_domain
if request.host == 'appname.heroku.com'
redirect_to "http://yourdomain.tld#{request.request_uri}", :status=>301
end
end
---->8
(big thanx to David from suppport!)
regards
D