lifton/rubycas-server — pull request #6 by adaburrows (2012-10-02 21:58:22+00:00)
Title: Session vs. Direct Cookie Acess Bugfix

We initially thought that adding a Rack session helper in front of the
application would allow us to invalidate session by adding in a session
secret. This turned out not to work.

What actually happened was the old session did not match what Rack's
session management expected and the cookie was destroyed. Then CAS
would set and retreive its cookie directly, which would again clobber
the cookie. Then the cycle repeated and all the user got was some lousy
crumbs which wouldn't track their ticket granting ticket at all.

FIX: Conditionally add the session helper. Add three helper methods
for accessing the cookies or session (which depend on if the session
middle ware was loaded or not). Choice of cookie/session & methods
used depends on the the presence of the session secret.