235 Cookies and Rails Sessions [1d]

Cookies are how a web application remembers a user between requests. This lesson covers how cookies work, how Rails sessions build on them, and what signed, encrypted and SameSite cookies protect against.

Important

Work on this lesson in advisor mode.

Learning goals

• You can explain what a cookie is, how browser and server exchange it, and which attributes control its lifetime and scope (expiry, domain, path, Secure, HttpOnly, SameSite).
• You can explain how a Rails session builds on cookies, and why a "session cookie" is something else.
• You can explain what signed and encrypted cookies protect against, and when you need which.
• You can read, set and delete cookies and session data in a Rails app.
• You can compare cookies with Web Storage (local and session storage) and say when each is appropriate.
• You can judge whether a piece of state belongs in a cookie, in the session, in the database — or nowhere on the server at all.

Learn

• What is a Cookie? Google it if you do not know.
• How are cookies transferred between your browser and the server?
  • Open the development tools in your browser for this page. Can you find the cookies your browser stores for makandracards?
  • In the network tab, can you see how the cookies are transferred to or from the server?
  • Can you log yourself out by manipulating a cookie? Can you log yourself back in?
• Understand what domains mean to cookies
  • Can cookies be shared between domains?
  • Between subdomains?
• How do cookies expire? What are "session" cookies?
• What does a cookie's "secure" flag do? Is it still relevant with HSTS?
• Look at Rails' API for managing cookies Show archive.org snapshot
  • How do you set and delete cookies?
  • What are signed cookies and how do they work?
  • What are encrypted cookies and how do they work?
• Learn about Rails sessions Show archive.org snapshot (which are not the same as 'session cookies')
• Learn about the SameSite cookie attribute
• What is "Local storage" and "Session storage" and how do they compare with cookies?
  • Have look at the MDN page Show archive.org snapshot and Unpoly's comparison table Show archive.org snapshot . You don't have to understand what a layer context is, we'll talk about Unpoly in a later card

Resources

Read what's new to you, skim what's familiar, skip what you already master. Stop when you can meet the learning goals.

Your agent can also generate an overview, a tutorial or an explanation for anything here, tailored to what you already know. Just ask.

• 📄 Using HTTP cookies Show archive.org snapshot — MDN: how cookies are exchanged, lifetime, domain and path, Secure, HttpOnly, SameSite
• 📄 Rails Guide: Session Show archive.org snapshot and Cookies Show archive.org snapshot — session stores, working with the session, encrypted and signed cookies
• 📄 ActionDispatch::Cookies Show archive.org snapshot — Rails API: reading, setting and deleting cookies, signed and encrypted
• 📄 How Rails sessions work Show archive.org snapshot — Justin Weiss; why a Rails session is not the same as a "session cookie"
• 📄 SameSite cookies — our card
• 📄 Web Storage API Show archive.org snapshot — MDN: local and session storage compared with cookies

Exercises

Star movies

• In your MovieDB, implement a "Recently viewed" feature: the last five movies the visitor looked at appear in a small list, newest first.
• Implement this with cookies or sessions without writing anything to the database. It should work without signing in.
• You can decide whether the cookie is manipulated by the server or the client.
• Is a cookie a good place for this data? What would change if we stored it in the database instead — and what would break for signed-out visitors?