How to empty/destroy a session in rails?

Question

I can't seem to find it anywhere... How do I delete/destroy/reset/empty/clear a user's session in Rails? Not just one value but the whole thing..

Norton

Answer 1

To clear the whole thing use the reset_session method in a controller.

reset_session

Here's the documentation on this method: http://api.rubyonrails.org/classes/ActionController/Base.html#M000668

Resets the session by clearing out all the objects stored within and initializing a new session object.

Good luck!

Fennel

For database-based sessions (which you should probably use) you can expire through a query: guides.rubyonrails.org/security.html#session-expiry – Antibaryon

Answer 2

session in rails is a hash object. Hence any function available for clearing hash will work with sessions.

session.clear

or if specific keys have to be destroyed:

session.delete(key)

Tested in rails 3.2

added

People have mentioned by session={} is a bad idea. Regarding session.clear, Lobati comments- It looks like you're probably better off using reset_session [than session.clear], as it does some other cleaning up beyond what session.clear does. Internally, reset_session calls session.destroy, which itself calls clear as well some other stuff.

Gyroscope

Anybody have any thoughts on the merits of this method vs the one recommended by Gdeglin? – Thruster

This can be used when you want to retain other parameters but delete one particular key value pair. – Gyroscope

I suppose I was referring to the use of either session.clear or session = {} vs the use of reset_session. Are they identical? – Thruster

This will not reset the session at all, it will assign a local variable. Never use this technique to reset the session: session = {} – Chet

The Rails documentation, on section 5.1 Accessing the Session recommends to use reset_session if you want remove script-inserted key/value pairs (ex: Something inserted from a controller) and generate a new session. If you want reset only the key/value pairs you set, set those keys to nil. – Diverticulosis

Downvote for same reason as @Chet mentions. session = {} does nothing but set an empty local variable, which creates an insidious bug in your application and still leaves the session floating around untouched. – Hypopituitarism

@Hypopituitarism What about the other thing the answerer suggested, session.clear Is that OK? What exactly is the difference between session.clear and the other answer of reset_session? – Carman

@Carman It looks like you're probably better off using reset_session, as it does some other cleaning up beyond what session.clear does. Internally, reset_session calls session.destroy, which itself calls clear as well some other stuff. – Hypopituitarism

Answer 3

to delete a user's session

session.delete(:user_id)

Syst

Careful, you can delete the user record from the database! – Fifine

@Fifine That's not true. But you'll only delete the :user_id key from the session and not the whole session – Easton

Answer 4

To clear only certain parameters, you can use:

[:param1, :param2, :param3].each { |k| session.delete(k) }

Boethius

Answer 5

add this code to your ApplicationController

def reset_session
  @_request.reset_session
end

( Dont know why no one above just mention this code as it fixed my problem ) http://apidock.com/rails/ActionController/RackDelegation/reset_session

Victualage

I find that @_request.reset_session and reset_session both work and maybe do the same thing? – Carman

Oh my god i was searching fot 2 weeks and dealing with this issue. Thank you so much for the support. – Chu