I have been looking at session deletion in my application and I noticed that the active_record_store record deletion isn’t consistent when using ActionController::Base.reset_session. Below is my logout endpoint

def destroy
    reset_session

    redirect_to root_path
  end

Its not that the session record is not being deleted but it is not consistent. Also although not reproducible, I think its using old session records and their data when the user logs in again. Just encountered a bug like that. I am not sure if this is due to a race condition or something else.

My sessions table

create_table "sessions", force: :cascade do |t|
    t.string "session_id", null: false
    t.text "data"
    t.datetime "created_at", precision: 6, null: false
    t.datetime "updated_at", precision: 6, null: false
    t.index ["session_id"], name: "index_sessions_on_session_id", unique: true
    t.index ["updated_at"], name: "index_sessions_on_updated_at"
  end

So I am confused if I should stick to this or find another way of handling session deletion.

I have been looking about this inconsistency and found a couple of issues in the activerecord-session_store repo but haven’t had confirmed issue or solution to this. Issue 1 , Issue 2.

Versions

Rails: 6.1.4
Ruby: 2.7.2