Fear of Fish

Most of you will know by now, that ActiveRecord isn’t the fastest ORM on the planet, so why use it for storing session data in your database? Plan A would be to flip over to SqlSession, which bypasses the ActiveRecord method and goes straight to the database. That’s fine for most sites, but what about those really high traffic sites?

Alexey Kovyrin (for scribd.com) has written the ultimate solution, FastSessions. FastSessions uses some clever MySQL (no, it’s not agnostic) tricks to make for real speedy session storing and lookup. Now I’m no database guru, but this plugin is by one of the MySQL Performance Blog fella’s so you can be sure that it does exactly what it says on the tin.

Installation and use is easy as pie:

  piston import http://rails-fast-sessions.googlecode.com/svn/trunk/ vendor/plugins/fast_sessions

Rails environment configuration:

  config.action_controller.session_store = :active_record_store

Set up your migration to create the table:

  ./script/generate fast_session_migration AddFastSessions

Run the migration:

  rake db:migrate

Little tricks like not saving the session data back to the database unless it changes, or is not empty, make for a huge saving over time.

Read more about it here: http://code.google.com/p/rails-fast-sessions/.

Every time a user logs on to your Rails site, they enter a username or password. The login form you’ve created no doubt POST’s that value to your Rails application, which it then kindly logs in your production.log. This is fine for development, but what about when you deploy your site to your production environment? That’s right, for however long you store your logs (I’ve seen some customers keep 3+ years worth of logs), those user passwords will be sat in that log. This isn’t the most secure way of handling this. Rails is set up to be able to filter these though, but how? Use the following snippet to instruct your Rails application to filter any parameters called ‘password’:

  class ApplicationController < ActionController::Base
    filter_parameter_logging "password"
  end