use session id objects

lib/rack/session/abstract/id.rb

@@ -18,6 +18,20 @@ def empty?; true; end
       def nil?; true; end
     end
 
+    class SessionId
+      attr_reader :public_id
+
+      def initialize(public_id)
+        @public_id = public_id
+      end
+
+      alias :cookie_value :public_id
+
+      def empty?; false; end
+      def to_s; raise; end
+      def inspect; public_id.inspect; end
+    end
+
     module Abstract
       # SessionHash is responsible to lazily load the session from store.
 
@@ -64,7 +78,11 @@ def each(&block)
 
         def [](key)
           load_for_read!
-          @data[key.to_s]
+          if key == "session_id"
+            id.public_id
+          else
+            @data[key.to_s]
+          end
         end
 
         def fetch(key, default = Unspecified, &block)
@@ -262,11 +280,13 @@ def initialize_sid
         # Monkey patch this to use custom methods for session id generation.
 
         def generate_sid(secure = @sid_secure)
-          if secure
+          public_id = if secure
             secure.hex(@sid_length)
           else
             "%0#{@sid_length}x" % Kernel.rand(2**@sidbits - 1)
           end
+
+          SessionId.new(public_id)
         rescue NotImplementedError
           generate_sid(false)
         end
@@ -296,7 +316,7 @@ def load_session(req)
         def extract_session_id(request)
           sid = request.cookies[@key]
           sid ||= request.params[@key] unless @cookie_only
-          sid || NullSessionId.new
+          (sid && SessionId.new(sid)) || NullSessionId.new
         end
 
         # Returns the current session id from the SessionHash.
@@ -367,7 +387,7 @@ def commit_session(req, res)
             req.get_header(RACK_ERRORS).puts("Deferring cookie for #{session_id}") if $VERBOSE
           else
             cookie = Hash.new
-            cookie[:value] = data
+            cookie[:value] = data.cookie_value
             cookie[:expires] = Time.now + options[:expire_after] if options[:expire_after]
             cookie[:expires] = Time.now + options[:max_age] if options[:max_age]
             set_cookie(req, res, cookie.merge!(options))

lib/rack/session/cookie.rb

@@ -153,6 +153,15 @@ def persistent_session_id!(data, sid = nil)
         data
       end
 
+      class SessionId < DelegateClass(Session::SessionId)
+        attr_reader :cookie_value
+
+        def initialize(session_id, cookie_value)
+          super(session_id)
+          @cookie_value = cookie_value
+        end
+      end
+
       def write_session(req, session_id, session, options)
         session = session.merge("session_id" => session_id)
         session_data = coder.encode(session)
@@ -165,7 +174,7 @@ def write_session(req, session_id, session, options)
           req.get_header(RACK_ERRORS).puts("Warning! Rack::Session::Cookie data size exceeds 4K.")
           nil
         else
-          session_data
+          SessionId.new(session_id, session_data)
         end
       end
 

lib/rack/session/memcache.rb

@@ -47,15 +47,15 @@ def initialize(app, options = {})
       def generate_sid
         loop do
           sid = super
-          break sid unless @pool.get(sid, true)
+          break sid unless @pool.get(sid.public_id, true)
         end
       end
 
       def get_session(env, sid)
         with_lock(env) do
-          unless sid and session = @pool.get(sid)
+          unless !sid.nil? and session = @pool.get(sid.public_id)
             sid, session = generate_sid, {}
-            unless /^STORED/.match?(@pool.add(sid, session))
+            unless /^STORED/.match?(@pool.add(sid.public_id, session))
               raise "Session collision on '#{sid.inspect}'"
             end
           end
@@ -68,14 +68,14 @@ def set_session(env, session_id, new_session, options)
         expiry = expiry.nil? ? 0 : expiry + 1
 
         with_lock(env) do
-          @pool.set session_id, new_session, expiry
+          @pool.set session_id.public_id, new_session, expiry
           session_id
         end
       end
 
       def destroy_session(env, session_id, options)
         with_lock(env) do
-          @pool.delete(session_id)
+          @pool.delete(session_id.public_id)
           generate_sid unless options[:drop]
         end
       end

lib/rack/session/pool.rb

@@ -45,24 +45,24 @@ def generate_sid
 
       def find_session(req, sid)
         with_lock(req) do
-          unless sid and session = @pool[sid]
+          unless !sid.nil? and session = @pool[sid.public_id]
             sid, session = generate_sid, {}
-            @pool.store sid, session
+            @pool.store sid.public_id, session
           end
           [sid, session]
         end
       end
 
       def write_session(req, session_id, new_session, options)
         with_lock(req) do
-          @pool.store session_id, new_session
+          @pool.store session_id.public_id, new_session
           session_id
         end
       end
 
       def delete_session(req, session_id, options)
         with_lock(req) do
-          @pool.delete(session_id)
+          @pool.delete(session_id.public_id)
           if options[:drop]
             NullSessionId.new
           else

test/spec_session_abstract_id.rb

@@ -27,7 +27,7 @@ def hex(*args)
       end
     end
     id = Rack::Session::Abstract::ID.new nil, secure_random: secure_random.new
-    id.send(:generate_sid).must_equal 'fake_hex'
+    id.send(:generate_sid).public_id.must_equal 'fake_hex'
   end
 
 end