Rack: Rack 1.6.12 gives an error when getting the session ID

[ljfc]

Upgrading to Rack 1.6.12 is giving us an error in some code related to logging – we use the session ID from Rack to help group errors relating to the same session together across services.

The line giving the error in Rack is here: https://github.com/rack/rack/blob/1.6.12/lib/rack/session/abstract/id.rb#L434

And the error is

undefined method `public_id' for nil:NilClass

The line in our code that calls it is an if statement checking if the session ID exists:

if env['rack.session'] && env['rack.session']['session_id']
  ... do stuff with env['rack.session']['session_id']
end

From the look of it, this used to return nil if the underlying hash key was absent, but now it seems to assume there _will_ be an id object if ["session_id"] is getting called. Is there something else we should be doing to determine if the session exists now?

I think this might be related to this as well, if it’s all to do with what the type of the id object is now: https://github.com/rack/rack/issues/1432

[utkarsh2102]

It seems like a regression of the security update which was recently rolled out.

1431 and #1432 are related.

Perhaps you might want to roll back to the previous version meanwhile?

[ljfc]

Thank you, yes we’ve caught this in CI, so we can stay on the previous version in production.

I just don’t want to get behind on security updates 😄

[jimbali]

1.16.12 (and 2.0.8) has broken a ton of different stuff as it was a breaking change masquerading as a patch version. Either it should be rewritten in a backwards-compatible way, or it should be rolled back and released as a major version. I'm assuming that Rack uses SemVer of course.

[amolpujari]

it is something to do with to_s, use inspect

``` [15] pry(#<HomeController>)> request.session_options[:id] "44ad88ec622813d1fa2bff525031c4f0" [16] pry(#<HomeController>)> request.session_options[:id].class Rack::Session::SessionId < Object [17] pry(#<HomeController>)> request.session_options[:id].to_s RuntimeError: from /home/amol/.rvm/gems/ruby-2.6.2@myproject/gems/rack-2.0.8/lib/rack/session/abstract/id.rb:31:into_s'
[18] pry(#)> request.session_options[:id].inspect
""44ad88ec622813d1fa2bff525031c4f0""
[19] pry(#)>

````

[NickTseng]

i has same issue , how to fiexd?

[mobilutz]

it is something to do with to_s, use inspect

[17] pry(#<HomeController>)> request.session_options[:id].to_s
RuntimeError: 
from /home/amol/.rvm/gems/ruby-2.6.2@myproject/gems/rack-2.0.8/lib/rack/session/abstract/id.rb:31:in `to_s'
[18] pry(#<HomeController>)> request.session_options[:id].inspect
"\"44ad88ec622813d1fa2bff525031c4f0\""

Unfortunately to_s and inspect return a different format - see the additional " which needs to be quoted.

I am running into this issue now as well in our tests together with ActionController::TestSession.

[velvetsnowman]

this is still an issue

[jimbali]

@tenderlove are you aware of this issue (and the related issue #1432) yet? It was due to a breaking change that was made by you a while ago which was released recently (as a patch version). I see that Rails 6 has been updated to be compatible with the new version of rack, but that's no good to us as we are stuck on Rails 4.2 with a legacy project. Is there any chance that this change could be made backwards-compatible? Otherwise we will be forced to stick with rack <= 1.6.11 (which tbf is a lesser issue than the fact that we are using an unsupported version of Rails).

[rafaelfranca]

Sorry, we see no way to make this fix backwards compatible.

[tenderlove]

@jimbali sorry, we did our best to make this as backwards compatible as possible while keeping applications secure. The only change in the patch release is a fix for this security issue. We did our best to make it as backwards compatible as possible, but it can't be 100% (unless you have a better solution).

[jimbali]

ok no worries, I'm just clutching at straws because our only alternative is upgrading an old and dying Rails 4.2 project to 5+, which tbf is what we should really be doing!

[jeremyevans]

The issue with to_s raising has been fixed by 88324d754671098a0693cc0c9568300bc96a6c94, and backported to 2.0 (46a6910f0be356221ef06543d1ef0e166d1014a6) and 1.6 (698a060133940a7d9a35c538890ab907f853250e).

The id.public_id issue should be fixable via something like id.public_id if id. I'll see if that works.