markevans/dragonfly — Issue #153: Cached dragonfly requests have incorrect cookies set
Author: tmeasday
Created: 2011-12-14 04:05:38+00:00
State: open

I'm on heroku cedar.

As suggested by the dragonfly/rails/images.rb file, I do this to put dragonfly behind rack::cache:

config.middleware.insert_after Rack::Cache, Dragonfly::Middleware, :images

So my middleware contains this:

use Dragonfly::CookieMonster
use Rack::Cache
use Dragonfly::Middleware

This is resulting in the following behaviour:

1. On the first request to a dragonfly end point (cache miss), the response has no cookies set.
2. On any subsequent hits to the image, cookies are set to a fixed value, determined by the first request.

This is a very serious bug as it leads to users being logged in as whichever user first requested the image. (Also because different cookies would get set by different images on the same page, it was extremely challenging to track down, but that is beside the point).

My guess as to what is happening is as follows:
In 1. Dragonfly::Middleware constructs a request, with a cookie set, and then rack-cache caches it. Then, CookieMonster, knowing this is a dragonfly request, strips the cookies, *outside* of the cache.

In 2. The request as cached is served, but CookieMonster doesn't realise it's a dragonfly request. So the cookies remain.

Obviously my analysis could be totally wrong.

I can see that somehow forcing my middleware to be in this order

use Rack::Cache
use Dragonfly::CookieMonster
use Dragonfly::Middleware

will help. But I wanted to make sure that this bug was posted as this could burn someone very badly..