redis-session-store 0.6.4 → 0.6.5

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA1:
-  metadata.gz: 2b6b105a9579a8c097a1234c80dc058309866fe6
-  data.tar.gz: 2c405132ca0f846a51189e8a63d0a02ab3d974b5
+  metadata.gz: 097d67a7b7dddb2f3b6d560c0dc3ac6c72c1adf2
+  data.tar.gz: 4cf3ce2dc51d8788b6400efa2c48d12c1f932b3a
 SHA512:
-  metadata.gz: af87b6104ce6ae3e347a22cc6da952c6aae4fd6ca758e563ebd03e2c966e6546270e152770b25820897e91a5f53d6ceae9c31049efb0105752af3d46798ed644
-  data.tar.gz: 5d4075ed6b6d493659b39d7feddc68b1cb9d8066659cba7147f9e47de3c7b4d749df56a6412d7c0f43936591288b9edf0b7d500259d1b5242380afec3e1919a1
+  metadata.gz: af6359ab62958e1542c55d93d7580343dfca3a00f8eef8c64c106b7213faea3f95341bdf0f8bf67a66682e86a22d897c901fedf53a8b049674a3aa6cef4a08de
+  data.tar.gz: bcd85e2e6d0df1a78fc28cdaab2ff67d0adfbaa3db288d7d0a3d8efe1c948ea852c7943e8623728cee6e39949f15b252da35e8da6e12bd707e749d13ff326f1c

data/CHANGELOG.md

@@ -1,6 +1,11 @@
 redis-session-store history
 ===========================
 
+## v0.6.5 (2014-04-04)
+
+* Fix issue #36, use setnx to get a new session id instead of get. This
+  prevents a very rare id collision.
+
 ## v0.6.4 (2014-04-04)
 
 * Reverting `setnx` usage in v0.6.3 so we can change our sessions.

data/lib/redis-session-store.rb

@@ -4,7 +4,7 @@ require 'redis'
 # Redis session storage for Rails, and for Rails only. Derived from
 # the MemCacheStore code, simply dropping in Redis instead.
 class RedisSessionStore < ActionDispatch::Session::AbstractStore
-  VERSION = '0.6.4'
+  VERSION = '0.6.5'
 
   # ==== Options
   # * +:key+ - Same as with the other cookie stores, key name
@@ -76,8 +76,8 @@ class RedisSessionStore < ActionDispatch::Session::AbstractStore
   end
 
   def sid_collision?(sid)
-    !!redis.get(prefixed(sid)).tap do |value| # rubocop: disable DoubleNegation
-      on_sid_collision.call(sid) if value && on_sid_collision
+    !redis.setnx(prefixed(sid), nil).tap do |value|
+      on_sid_collision.call(sid) if !value && on_sid_collision
     end
   end
 
@@ -177,8 +177,6 @@ class RedisSessionStore < ActionDispatch::Session::AbstractStore
       end
     end
 
-    private
-
     def self.needs_migration?(value)
       value.start_with?(MARSHAL_SIGNATURE)
     end

data/spec/redis_session_store_spec.rb

@@ -249,7 +249,7 @@ describe RedisSessionStore do
 
     context 'when destroyed via #destroy_session' do
       it 'deletes the prefixed key from redis' do
-        redis = double('redis', get: nil)
+        redis = double('redis', setnx: true)
         store.stub(redis: redis)
         sid = store.send(:generate_sid)
         expect(redis).to receive(:del).with("#{options[:key_prefix]}#{sid}")
@@ -264,18 +264,23 @@ describe RedisSessionStore do
 
     context 'when the generated sid is unique' do
       before do
-        redis = double('redis', get: nil)
+        redis = double('redis', setnx: true)
         store.stub(redis: redis)
       end
 
       it 'returns the sid' do
         expect(store.send(:generate_sid)).to_not be_nil
       end
+
+      it 'does not pass the unique sid to the collision handler' do
+        store.send(:sid_collision?, 'whatever')
+        expect(@sid).to eql(nil)
+      end
     end
 
     context 'when there is a generated sid collision' do
       before do
-        redis = double('redis', get: 'herp a derp')
+        redis = double('redis', setnx: false)
         store.stub(redis: redis)
       end
 
@@ -284,6 +289,22 @@ describe RedisSessionStore do
         expect(@sid).to eql('whatever')
       end
     end
+
+    it 'does not allow two processes to get the same sid' do
+      redis = Redis.new
+      store1 = RedisSessionStore.new(nil, options)
+      store1.stub(redis: redis)
+      store2 = RedisSessionStore.new(nil, options)
+      store2.stub(redis: redis)
+
+      # While this is stubbing out a method defined in spec/support.rb,
+      # Rails does use SecureRandom for the random string
+      store1.stub(:rand).and_return(1000)
+      store2.stub(:rand).and_return(1000, 1001)
+
+      expect(store1.send(:generate_sid)).to eq('3e8')
+      expect(store2.send(:generate_sid)).to eq('3e9')
+    end
   end
 
   describe 'session encoding' do

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: redis-session-store
 version: !ruby/object:Gem::Version
-  version: 0.6.4
+  version: 0.6.5
 platform: ruby
 authors:
 - Mathias Meyer
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2014-04-04 00:00:00.000000000 Z
+date: 2014-04-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: redis
@@ -142,7 +142,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
       version: '0'
 requirements: []
 rubyforge_project: 
-rubygems_version: 2.2.1
+rubygems_version: 2.2.2
 signing_key: 
 specification_version: 4
 summary: A drop-in replacement for e.g. MemCacheStore to store Rails sessions (and