Rails 6 session variables not persisting - ruby-on-rails

Question

I have a relatively new Rails 6 app (Rails 6.1.3.1), so there's not a whole lot of customization yet. However, I cannot get session variables to persist.
For example, if I put something like the following in a controller action:
class PagesController < ApplicationController
skip_before_action :authenticate_user!
def home
byebug
session[:foo] = 'bar'
end
end
I would expect session[:foo] to be nil on the first request, but I would expect it to be set to 'bar' on all subsequent requests. However, it's nil every time.
This is causing a major problem with CSRF functionality, because the session[:_csrf_token] is being reset on every request. This means that no request has a valid CSRF token, so I can't get login to work.
For the life of me, I cannot figure out what is going on. I've tried monkeying around with browser settings and environment settings, but nothing has worked.
I've been banging my head on this for a couple days now. What am I missing? What might cause the session to be reset on every request?
Here is some more context:
# Gemfile
source 'https://rubygems.org'
git_source(:github) { |repo| "https://github.com/#{repo}.git" }
ruby '3.0.1'
gem 'rails', '6.1.3.1'
gem 'pg'
gem 'puma'
gem 'bootsnap', require: false
gem 'jbuilder'
gem 'webpacker'
gem 'redis'
gem 'autoprefixer-rails'
gem 'aws-sdk-s3'
gem 'delayed_job_active_record'
gem 'devise'
gem 'image_processing'
gem 'kaminari'
gem 'money-rails'
gem 'pg_search'
gem 'postmark-rails'
gem 'pundit'
gem 'roadie-rails'
gem 'rollbar'
gem 'sassc-rails'
gem 'tailwindcss-rails'
gem 'view_component', require: 'view_component/engine'
group :development, :test do
gem 'byebug'
end
group :development do
gem 'guard'
gem 'guard-minitest'
gem 'binding_of_caller'
gem 'listen'
gem 'spring'
gem 'web-console'
end
group :test do
gem 'capybara'
gem 'minitest-focus'
gem 'minitest-rails'
gem 'minitest-reporters'
gem 'mocha'
gem 'pdf-inspector'
gem 'selenium-webdriver'
gem 'rexml'
gem 'webdrivers'
end
group :development, :production do
gem 'stripe'
end
# application.rb
require_relative "boot"
require "rails/all"
# Require the gems listed in Gemfile, including any gems
# you've limited to :test, :development, or :production.
Bundler.require(*Rails.groups)
class Env
def self.var(*args)
var = args.join('_').upcase
ENV[var] || Rails.application.credentials[Rails.env.to_sym].dig(*args)
end
end
module Foobar
class Application < Rails::Application
# Initialize configuration defaults for originally generated Rails version.
config.load_defaults 6.1
# Configuration for the application, engines, and railties goes here.
#
# These settings can be overridden in specific environments using the files
# in config/environments, which are processed later.
#
# config.time_zone = "Central Time (US & Canada)"
# config.eager_load_paths << Rails.root.join("extras")
config.autoload_paths += %W( #{config.root}/app/components )
config.autoload_paths += %W( #{config.root}/app/forms )
config.autoload_paths += %W( #{config.root}/app/utilities )
# Look in components folder when determining which classes to include.
config.assets.css_compressor = Tailwindcss::Compressor.new(files_with_class_names: Rails.root.glob("app/components/**/*.*"))
end
end
# application_controller.rb
class ApplicationController < ActionController::Base
include Pundit
protect_from_forgery with: :reset_session, prepend: true
before_action :authenticate_user!
default_form_builder Forms::Builder
attr_writer :title
helper_method :body_class, :title
def authorize(record, query = nil)
super([:authorization, record], query)
end
def body_class
"#{params[:controller].gsub('/', '_')}"
end
def policy_scope(scope)
super([:authorization, scope])
end
def title
#title || default_title
end
private
def default_title
controller_name.singularize.humanize.capitalize
end
end
# development.rb
require "active_support/core_ext/integer/time"
Rails.application.configure do
config.session_store :cache_store
# Settings specified here will take precedence over those in config/application.rb.
# In the development environment your application's code is reloaded any time
# it changes. This slows down response time but is perfect for development
# since you don't have to restart the web server when you make code changes.
config.cache_classes = false
# Do not eager load code on boot.
config.eager_load = false
# Show full error reports.
config.consider_all_requests_local = true
# Enable/disable caching. By default caching is disabled.
# Run rails dev:cache to toggle caching.
if Rails.root.join('tmp', 'caching-dev.txt').exist?
config.action_controller.perform_caching = true
config.action_controller.enable_fragment_cache_logging = true
config.cache_store = :memory_store
config.public_file_server.headers = {
'Cache-Control' => "public, max-age=#{2.days.to_i}"
}
else
config.action_controller.perform_caching = false
config.cache_store = :null_store
end
# Store uploaded files on the local file system (see config/storage.yml for options).
config.active_storage.service = :local
# Don't care if the mailer can't send.
config.action_mailer.raise_delivery_errors = false
config.action_mailer.perform_caching = false
config.action_mailer.default_url_options = { host: 'localhost', port: 3000 }
# Print deprecation notices to the Rails logger.
config.active_support.deprecation = :log
# Raise exceptions for disallowed deprecations.
config.active_support.disallowed_deprecation = :raise
# Tell Active Support which deprecation messages to disallow.
config.active_support.disallowed_deprecation_warnings = []
# Raise an error on page load if there are pending migrations.
config.active_record.migration_error = :page_load
# Highlight code that triggered database queries in logs.
config.active_record.verbose_query_logs = true
# Debug mode disables concatenation and preprocessing of assets.
# This option may cause significant delays in view rendering with a large
# number of complex assets.
config.assets.debug = false
# Suppress logger output for asset requests.
config.assets.quiet = true
# Raises error for missing translations.
# config.i18n.raise_on_missing_translations = true
# Annotate rendered view with file names.
# config.action_view.annotate_rendered_view_with_filenames = true
# Use an evented file watcher to asynchronously detect changes in source code,
# routes, locales, etc. This feature depends on the listen gem.
config.file_watcher = ActiveSupport::EventedFileUpdateChecker
# Uncomment if you wish to allow Action Cable access from any origin.
# config.action_cable.disable_request_forgery_protection = true
end

Answer 1

Ok, found the problem. Turns out that I had copied the setting config.session_store :cache_store in development.rb from a different project I had been working on. However, this setting was added as part of the StimulusReflex setup for that other project.
From the StimulusReflex docs:
Cookie-based session storage is not currently supported by StimulusReflex.
Instead, we enable caching in the development environment so that we can assign our user session data to be managed by the cache store.
The default setting for this option is cookie_store. By changing it to :cache_store without specifying a cache repo, it implements ActionDispatch::Session::CacheStore and defaults to storing it in Rails.cache, which uses the :file_store option, which dumps it in tmp/cache.
However, further down in development.rb, there is some conditional logic that assigns config.cache_store to :null_store if there is no caching-dev.txt file. This implements ActiveSupport::Cache::NullStore, which is "a cache store implementation which doesn't actually store anything."
So because I had not enabled caching with rails dev:cache for this project, the session cache was getting toasted with every request.
LESSON LEARNED: Be very careful when copying config settings from an old project to a new one!