Project

General

Profile

Forums » Help »

Users cannot accept cookies. How can I switch to DB managed sessions?

Added by Rodrigo Carvalho over 13 years ago

Due to internal security policy, my client cannot accept cookies from browsers. So whenever they try to login they get the 'Invalid Authenticity Form Token' message. How can I get around this? I know you can use a DB based session store instead (i.e. :active_record_store in sessions_store.rb), but all my attempts at doing so have failed so far. I'm using a BitNami distribution at the moment, but have already tried the installation instructions on <a href="http://www.redmine.org/projects/redmine/wiki/HowTo_Install_Redmine_in_a_sub-URI_on_Windows_with_Apache">here</a> with no success.

- Redmine 1.0.0
- Apache 2.2.14
- ImageMagick 6.5.6-8-Q8
- MySQL 5.0.83
- Subversion 1.6.6
- Ruby 1.8.7-p249-i386-mingw32
- Rails 2.3.5
- RubyGems 1.3.6

I am a bit of a newbie with managing RoR applications, and at this point I have completely ran out of ideas. Any help is much appreciated.

Thanks!


Replies (2)

RE: Users cannot accept cookies. How can I switch to DB managed sessions? - Added by Felix Schäfer over 13 years ago

Rodrigo Carvalho wrote:

Due to internal security policy, my client cannot accept cookies from browsers. So whenever they try to login they get the 'Invalid Authenticity Form Token' message. How can I get around this?

You can't.

You're confusing two things here: sessions and cookies. The sessions can be stored in cookies, but not storing them in cookies doesn't remove the need for cookies (when the session is not stored in the cookie, rails still sets a cookie with a (encrypted and signed) key to retrieve the correct session for the current user).

I haven't given it much thought, but off the top of my head, I'd say it's difficult to make a rails app not use cookies, and I think even more so in Redmine.

RE: Users cannot accept cookies. How can I switch to DB managed sessions? - Added by Rodrigo Carvalho over 13 years ago

Thanks for the reply Felix. From experimentation with various setups, I have managed to make the above Redmine installation work on IE 8 while blocking cookies (tools > internet options > privacy > advanced > select override... and block in both columns). The same does not work with Firefox however.

Having said that, I can only access redmine while blocking cookies localy (i.e. localhost/redmine). When I try on a remote IE 8 browser with the same cookie blocking settings, the same doesn't work (i.e. www.foo.com/redmine). Is there anything you know about that?

    (1-2/2)