Rails Login Reset Session

Question

Is it best practice to call reset_session when a user successfully signs in and to call it again when a user signs out? Are there any side effects/problems to doing this?

Answer 1

A lot of the answers here haven't aged well due to the Rails API changing so I'll just leave one here that works as of Rails 5.0 at least.

As others have noted the Rails Security Guide recommends calling reset_session on login to avoid session fixation attacks.

You may want your session cleared on login but if you just want to change the session id and keep everything else (i.e. no side-effects) you can do it like this:

def mitigate_session_fixation
  old_values = session.to_hash
  reset_session
  session.update old_values.except('session_id')
end