I and some others have hit a bug where rfacebook 0.98 causes Rails to share sessions between multiple different
clients.
See this posting for other reports of the problem:
http://groups.google.ca/group/rubyonrails-talk/browse_thread/thread/e793facba9bfa0f0/9017569ae6e70cce?lnk=raot
I think I found the bug in session_extensions.rb
Original code (excerpt):
def session_id_available?(request) # :nodoc:
# TODO: we should probably be checking the fb_sig...
return (lookup_request_parameter(request, "fb_sig_in_canvas") or
lookup_request_parameter(request, "fb_sig_is_ajax"))
end
The problem is lookup_request_parameter returns "" (not nil) if it
does not find the param, so this is returning true even when
fb_sig_in_canvas and fb_sig_is_ajax are not present.
Here's the fix I jammed in -- don't know if this has unintended
consequences, but it did immediately solve the session reuse bug:
def session_id_available?(request) # :nodoc:
fb_sic = lookup_request_parameter(request, "fb_sig_in_canvas")
fb_sia = lookup_request_parameter(request, "fb_sig_is_ajax")
return ((fb_sic and (fb_sic.length > 0)) or (fb_sia and
(fb_sia.length > 0)))
end
Mike |
