Merge pull request #37 from mstruve/ignore-blank-sessions

Don't Store Blank Session Keys in Redis
redis-store · Sep 27, 2018 · a7cfaf1 · a7cfaf1
2 parents fad94f8 + 53493e8
commit a7cfaf1
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/lib/rack/session/redis.rb b/lib/rack/session/redis.rb
@@ -20,6 +20,7 @@ def initialize(app, options = {})
       end
 
       def generate_unique_sid(session)
+        return generate_sid if session.empty?
         loop do
           sid = generate_sid
           first = with do |c|

diff --git a/test/rack/session/redis_test.rb b/test/rack/session/redis_test.rb
@@ -90,6 +90,12 @@
     sesion_store.threadsafe?.must_equal(true)
   end
 
+  it "does not store a blank session" do
+    session_store = Rack::Session::Redis.new(incrementor)
+    sid = session_store.generate_unique_sid({})
+    session_store.with { |c| c.get(sid).must_be_nil }
+  end
+
   it "locks the store mutex" do
     mutex = Mutex.new
     mutex.expects(:lock).once