Using different redis stores for session and caching in Rails 5

Question

I am a newbie to Ruby and Rails. I am building a web application using Ruby on Rails 5.2. I have configured it to use the redis-cache-store to manage the view caching:

config.cache_store = :redis_cache_store, { driver: :hiredis, namespace: "my-app", compress: true, url: ENV["REDIS_URL"] }

And I have configured my session storage as:

Rails.application.config.session_store :cache_store, {
  key: "sid",
  expire_after: 30.minutes
}

So here I am using the :cache_store as my session store. As far as I understand, this means the entries for the view cache and the session data are stored in the same Redis database.

From what I understand, the redis-rails gem is no longer required if using Rails 5.2 as there is a built-in support for redis - https://github.com/redis-store/redis-rails#a-quick-note-about-rails-52. Hence, I have not used that gem.

Is there a way to use a different redis store for sessions and different one for view caching?

Or am I trying to do something which is unusual in Rails-land?

Dignify

Answer 1

To separately configure your session store to use Redis, you'll need to use a gem that provides a Redis session store: either redis-store (note redis-activesupport is deprecated, but redis-actionpack is not), or redis-session-store.

You can't configure the session storage separately while using the :cache_store session store, because that stores sessions in the actual cache... it's not just "cache-like" storage, so it can't override / behave differently from the cache itself.

Storing session contents somewhere other than a cookie is somewhat unusual, now that session cookies are encrypted as well as tamper-proof, but it's not rare. If you're going to, Redis is a good choice.

Ladanum

Storing session contents somewhere other than a cookie is somewhat unusual, now that session cookies are encrypted as well as tamper-proof. Does it prevent from session replay attacks ? – Bott

"Storing session contents somewhere other than a cookie is somewhat unusual, now that session cookies are encrypted as well as tamper-proof, but it's not rare." It allows you display where a user is logged in as well as invalidate (logout) signed in sessions. – Cassimere