Replace session backend with something cross-process about carnival HOT 5 CLOSED

According to the Yesod book, the default session store is cookie like Rails http://www.yesodweb.com/book/sessions

I still think that there may be issues with cross-dyno access to it, but maybe we can solve it through configuration.

from carnival.

For reference, here's is the framework code: https://github.com/yesodweb/yesod/blob/master/yesod-core/Yesod/Core/Internal/Session.hs

And here is the library it delegates most of the work to: http://hackage.haskell.org/package/clientsession-0.9.0.3/docs/Web-ClientSession.html

I just realized that the session key is stored on the filesystem in ./config/client_session_key.aes. I believe the key is randomly generated as needed. Since we don't store this file in VCS and heroku's file systems are ephemeral, it's different on each dyno (and every restart). I'm not sure there's a way to configure the framework to read the key from an environment variable -- I may open an issue, once we confirm this is the problem, and take a swing at a PR to make it possible.

As a workaround we could commit the file for now.

from carnival.

Yeah, ok - Here is a thread about overriding the session backend behavior
https://groups.google.com/forum/#!searchin/yesodweb/session$20key/yesodweb/Ocbz83hiLB4/L9jo45KB_DEJ

from carnival.

Hmm, promising. I wonder if it's as easy as...

makeSessionBackend _ = fmap Just $ do
        let minutes = (120 * 60) -- 120 minutes
        key <- -- Something custom that reads an environment variable
        let timeout = fromIntegral (minutes * 60)
        (getCachedDate, _closeDateCacher) <- clientSessionDateCacher timeout
        return SessionBackend
            { sbLoadSession = loadClientSession key getCachedDate "_SESSION"
            }

Unfortunately, I don't think the key value is a simple string (like Rails), so using an environment variable could require a bit more.

from carnival.

This was done and pushed mid-week.

from carnival.