Rails.cache.clear正在注销所有已登录的用户（清除会话）

Question

While we were using FileStore as cache store and DalliStore as session store, we could run Rails.cache.clear and it would simply clear the cache with no problems in Sessions whatsoever.

Now that we moved the cache store to mem_cache_store, if we run Rails.cache.clear we clear the cache but also sign out every user, destroying all sessions.

Is this the intended behavior?

Answer 1

@phoet was right on. In my initializers/session_store, config.session_store was set to CacheStore. That's not the default in Rails 4, which is :cookie_store.

What is confusing (and now I see the light) is this: no matter what cache store mecanism you choose, there will always be a cookie stored in the browser (with the name you set in that same file, right after the store mecanism, in the key: 'xxx' option - this key is actually the cookie name and has nothing to do with the key you set in secrets.yml to encrypt it).

If you use the default store mecanism (:cookie_store), the entire "session hash" will be stored in the cookie, and nothing on the server (database/memcached). Everything will be read and written directly in that cookie (which starting in Rails 4 is always encrypted if you set secret_key_base).

If you use any other storage (like CacheStore or ActiveRecordStore), the cookie will still be there, with the same name you set in the 'key' option, BUT it if you decoded it (you need the secret_key_base for that, google for decoding rails 4 session) you'll see will only contain the session ID, and then Rails will look for the data corresponding to that session either in the database (ActiveRecord) or memcached (CacheStore, considering you are using memcached and not FileStore for storing cache, but that's another config).

So, since my session store was set to CacheStore, when I did Rails.cache.clear the cookie wasn't being deleted (that's on the client side of course), but when Rails got the session ID inside that cookie it couldn't find anything in memcached to match it with.