Delete Session Cookies Across Multiple Subdomains in Rails 3

Question

I'm building a rails app that works similar to Wufoo. When you sign up you get a subdomain, and you can log in on the home page. The app is working, so that when you log in, you get redirected to your subdomain. The problem is that I can't delete the session on both domains. If you log out at (username.myapp.com), it stays logged in at (myapp.com) and vice versa.

Right now I'm using session[:user_id] = nil to delete the session. Is there a way to delete all the sessions across all domains.

In addition, I appended :domain => :all to my session_store.rb file so I could stay logged in across multiple subdomains.

Answer 1

The key is really how you set your session cookies, because you can't delete a subdomain cookie (username.myapp.com) from a top-level domain (myapp.com). To solve this you'll want all your shared session cookies to be set under the myapp.com domain. To do this, setup your sessions in the following way:

Rails.application.config.session_store :cookie_store, :domain => 'myapp.com'

That way, when you destroy your session (session[:id] = nil) you'll be removing the shared cookie. I believe you will also have to delete the session using session[:id] instead of session[:user_id].