actionpack/lib/action_controller/metal/session_management.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56

module ActionController #:nodoc:
  module SessionManagement #:nodoc:
    extend ActiveSupport::Concern

    included do
      self.config.session_store   ||= :cookie_store
      self.config.session_options ||= {}
    end

    module ClassMethods
      # Set the session store to be used for keeping the session data between requests.
      # By default, sessions are stored in browser cookies (<tt>:cookie_store</tt>),
      # but you can also specify one of the other included stores (<tt>:active_record_store</tt>,
      # <tt>:mem_cache_store</tt>, or your own custom class.
      def session_store=(store)
        ActiveSupport::Deprecation.warn "Setting session_store directly on ActionController::Base is deprecated. " \
                                        "Please set it on config.action_controller.session_store"
        config.session_store = store
      end

      def session_options=(opts)
        ActiveSupport::Deprecation.warn "Setting seession_options directly on ActionController::Base is deprecated. " \
                                        "Please set it on config.action_controller.session_options"
        config.session_store = opts
      end

      def session_options
        config.session_options
      end

      def session_store
        case store = config.session_store
        when :active_record_store
          ActiveRecord::SessionStore
        when Symbol
          ActionDispatch::Session.const_get(store.to_s.camelize)
        else
          store
        end
      end

      def session=(options = {})
        self.session_store = nil if options.delete(:disabled)
        session_options.merge!(options)
      end

      def session(*args)
        ActiveSupport::Deprecation.warn(
          "Disabling sessions for a single controller has been deprecated. " +
          "Sessions are now lazy loaded. So if you don't access them, " +
          "consider them off. You can still modify the session cookie " +
          "options with request.session_options.", caller)
      end
    end
  end
end