Ruby-on-rails 在 Rails 3 中设置会话超时
声明：本页面是StackOverFlow热门问题的中英对照翻译，遵循CC BY-SA 4.0协议，如果您需要使用它，必须同样遵循CC BY-SA许可，注明原文地址和作者信息，同时你必须将它归于原作者（不是我）：StackOverFlow
原文地址: http://stackoverflow.com/questions/5860950/
Warning: these are provided under cc-by-sa 4.0 license. You are free to use/share it, But you must attribute it to the original authors (not me):
StackOverFlow
Setting session timeout in Rails 3
提问by Ciaran Archer
This seems simple: I am trying to get my rails Active Record session to timeout after 2 minutes. So after two minutes I want my users to have to re-login.
这看起来很简单：我试图让我的 rails Active Record 会话在 2 分钟后超时。所以两分钟后，我希望我的用户必须重新登录。
I'm just running rails server(i.e. WebBrick) on my local dev machine.
我只是rails server在我的本地开发机器上运行（即 WebBrick）。
I know this is something to do with the following code in config/initalizers/session_store.rb, but I don't think I have quite nailed it:
我知道这与 中的以下代码有关config/initalizers/session_store.rb，但我认为我还没有完全掌握它：
CodedOn::Application.config.session_store :active_record_store
CodedOn::Application.configure do
config.action_controller.session = {:expire_after => 2.minutes}
end
This doesn't seem to work, or at least my session doesn't appear to timeout. I can't find much about the Rails 3 way to do this as I know things have changed from Rails 2.x.
这似乎不起作用，或者至少我的会话似乎没有超时。我找不到太多关于 Rails 3 的方法来做到这一点，因为我知道事情从 Rails 2.x 开始发生了变化。
Can some one help me out?
有人可以帮我吗？
回答by moritz
I think you will have to do this manually since the active record store does not implement the expire_after option. So within your (I assume) before filter, you should do this:
我认为您必须手动执行此操作，因为活动记录存储未实现 expire_after 选项。所以在你的（我假设）过滤器之前，你应该这样做：
def authenticate
if session[:logged_in]
reset_session if session[:last_seen] < 2.minutes.ago
session[:last_seen] = Time.now
else
... authenticate
session[:last_seen] = Time.now
end
end
Obviously, this is not complete, but it should give you the basic idea.
显然，这并不完整，但它应该为您提供基本概念。
UPDATE:
更新：
It seems that the functionality IS present in rails since version 2.3. I found the relevant code here. This is AbstractStore which should serve as base class for all derived ones. So, as dadooda suggests, the following should work:
自 2.3 版以来，该功能似乎存在于 rails 中。我在这里找到了相关代码。这是 AbstractStore，它应该作为所有派生类的基类。因此，正如 dadooda 所建议的，以下应该有效：
Some::Application.config.session_store :active_record_store, {
expire_after: 24.hours,
}
回答by Ravindra
I did this in simple way you can try this:
我以简单的方式做到了这一点，你可以试试这个：
In your config/initializers/session_store.rbjust do this:
在你config/initializers/session_store.rb只是这样做：
Yourapp::Application.config.session_store :cookie_store,
:key => "_yourapp_session",
:expire_after => 2.minutes
This is working for me finely, hope works for you also.
这对我来说很好，希望也对你有用。
回答by Alex Fortuna
mosch says:
mosch 说：
I think you will have to do this manually since the active record store does not implement the expire_after option.
我认为您必须手动执行此操作，因为活动记录存储未实现 expire_after 选项。
It seems it's no longer this way. :expire_afterworked for me in Rails 3.2.11:
好像已经不是这样了。:expire_after在 Rails 3.2.11 中对我来说有效：
Some::Application.config.session_store :active_record_store, {
key: "some_session_id",
domain: ".isp.com",
expire_after: 24.hours,
}
The cookie auto-prolongs after every request towards the app. The session persists through browser exits.
每次向应用发出请求后，cookie 都会自动延长。会话通过浏览器退出持续存在。
I did the above trick to "globalize" the session across domain for a simple SSO functionality, seems to work so far.
我做了上述技巧来“全球化”跨域会话以获得简单的 SSO 功能，到目前为止似乎有效。
回答by m33lky
You have to do it manually. Here's an example of creating a class method for ActiveRecord sessions. You can use Rufus-Scheduler and/or DelayedJob to regularly call this.
你必须手动完成。下面是为 ActiveRecord 会话创建类方法的示例。您可以使用 Rufus-Scheduler 和/或 DelayedJob 定期调用它。
class Session < ActiveRecord::Base
def self.sweep(time = 1.hour)
if time.is_a?(String)
time = time.split.inject { |count, unit| count.to_i.send(unit) }
end
delete_all "updated_at < '#{time.ago.to_s(:db)}' OR created_at < '#{2.days.ago.to_s(:db)}'"
end
end
More background on why it's important: http://guides.rubyonrails.org/security.html#session-expiry
更多关于为什么它很重要的背景：http: //guides.rubyonrails.org/security.html#session-expiry
回答by regmiprem
The expiration time.
到期时间。
MAX_SESSION_TIME = 60 * 60
before_filter :prepare_session
def prepare_session
if !session[:expiry_time].nil? and session[:expiry_time] < Time.now
# Session has expired. Clear the current session.
reset_session
end
# Assign a new expiry time, whether the session has expired or not.
session[:expiry_time] = MAX_SESSION_TIME.seconds.from_now
return true
end
回答by GG.
Just add timeout_in method in your model and it should do the trick:
只需在您的模型中添加 timeout_in 方法，它应该可以解决问题：
def timeout_in
2.minutes
end
