performance of ActiveRecord SessionStore

Question

How big is the performance penalty switching from the cookieStore to the ActiveRecord SessionStore?

By default Ruby on Rails uses the CookieStore. But it has the disadvantage that the client needs to have its cookies enabled.

Switching to the Active SessionStore seems to solve that problem. I'm considering switching.

I read that performance is worse using the ActiveRecord SessionStore. But what is worse? Will a user notice this, or is it a matter of milliseconds? Anybody has seen benchmark results comparing the 2 options?

Any other reasons (not) to switch to the ActiveRecord SessionStore?

Answer 1

What is worse is that it needs to query a database, which then needs to calculate the answer, rather than going straight to the cookie on the client side.

However is it really that bad? You are correct in that the performance difference is very minuscule in most cases.

Pros:

Affinity- If your web application ever expands to more than one server, moving your sessions to a database can allow you to run your servers without server affinity.

Security - Since you only store the session ID on the client side, this reduces the chances of the user manipulating any data via the client side.

Cons

Performance - Instead of querying the database, you can just read the session/cookie data from the client side.

Answer 2

But the AR session store also depends on cookies - it saves the session id there.

As far as I know there is no way to make Rails sessions work with cookies disabled.