Session cookie expiration time in Rails

By default Rails do not support setting expiration of session cookies to ” after last visit”. The code at Rails wiki shows how to set up cookie expiration for a whole application, but it does not support setting this per-controller (or per-action) like other session options, due to the use of class variables.

This became a problem for us recently, as I needed to set different session cookie expiration times for different controllers.

Here is the solution, rewritten from scratch:

# -- put this into vendor/plugins/sliding_sessions/init.rb --
module SlidingSessions
  # Allows using :session_expires_after option for session cookies
  # NOTE it does not perform any checks on server-side, it just
  # sets the session cookie expiration time.
  # see http://wiki.rubyonrails.org/rails/pages/HowtoChangeSessionOptions
  # for a recipe to perform server-side expiration checks

  # (C) Paweł Stradomski , released under MIT licence
  def self.extended(base)
    class << base
      alias_method :session_options_for_without_sliding, :session_options_for
      alias_method :session_options_for, :session_options_for_with_sliding
    end
  end

  def session_options_for_with_sliding(request, action) #:nodoc:
    opts = session_options_for_without_sliding(request, action)
    if opts[:session_expires_after] then
      opts[:session_expires] = Time.now + opts[:session_expires_after]
    end
    opts
  end
end

ActionController::Base.extend(SlidingSessions)

# — end of vendor/plugins/sliding_sessions/init.rb –

The above code (module definition + ActionController::Base.extend(SlidingSessions)) should be put into vendor/plugins/sliding_sessions/init.rb

Now you can use

session :session_expires_after => 8.hour # in any controller

in any of your controllers, even application.rb

Of course it only deals with session cookies, you still need to perform server-side checks for expired sessions and write a cron job to remove stale sessions.