OK, here it is: svn://svn.madriska.com/plugins/raisin_cookies To use, install the plugin and start up the DRb server from the DRb session store (action_controller/session/drb_server.rb).
The DRb server keeps a hash mapping session HMACs to the latest nonce used with the session. The nonce is verified along with the HMAC on unmarshal. That way, old sessions are invalidated because the HMAC of the session must be presented with the latest nonce stored in the DRb backend. Right now, the code issues a new nonce on each update; it should probably check first to see if the data has been updated, but it doesn't right now. Very simple benchmarking shows a 10-15% impact on reqs/sec with this plugin. I would guess that most of that comes from the nonce generation (I use Rails's CGI::Session.generate_unique_id, which has to create an MD5 hash for each session). I don't really have the time to look further, however. I only tested with a single Mongrel. Does anyone care to do some performance studies on this? Brad On Mar 23, 2007, at 11:52 AM, Brad Ediger wrote: > Good points. I worked up a quick plugin that uses DRb to store the > nonce, and I'm doing some benchmarks on it now. I don't have time > for anything fancy, but we can at least get in the ballpark. > <snip> >> >> Anyone care to try a generic, automatic nonce and benchmark the >> results? >> >> jeremy --~--~---------~--~----~------------~-------~--~----~ You received this message because you are subscribed to the Google Groups "Ruby on Rails: Core" group. To post to this group, send email to [email protected] To unsubscribe from this group, send email to [EMAIL PROTECTED] For more options, visit this group at http://groups.google.com/group/rubyonrails-core?hl=en -~----------~----~----~----~------~----~------~--~---
