ARs in the session have their associations persisted as well

This shouldn't happen. Which session store is used by your app?

I am using PStore.

I'm experiencing the same problem. I'm just using the default filesystem session storage.

I found this new comment in session_management.rb in the latest active record gem (1.12.1):

# Clear cached associations in session data so they don't overflow
# the database field.  Only applies to ActiveRecordStore since there
# is not a standard way to iterate over session data.
def clear_persistent_model_associations

If associations are really not being cleared for anything but AR stored sessions, I'm amazed more people aren't reporting problems (with stale data in their sessions).

I'm going to try switching to AR storage.

Switching to the ActiveRecordStore didn't help much. Actually, the method I was looking at in session_management.rb hasn't really changed and the clearing should work for all storage implementations. I added some logging and confirmed that it was working. At that point, I can look at the session data, follow the references, see the sql running in the logs and everything looks fine. By the time my controller is run and my templates rendered, I have the old state data so something wierd is happening. Your workaround, however, works for me and fixes the problem. It's all very strange. Are you using the login_engine? Maybe it has something to do with that.

I am using a highly modified version of the salted-hash login generator, with localization completely stripped out. I think login_engine is the engine version of that? (If I had to do it again I would've used acts as verified). Thanks for the lead. I haven't had much time to work on this, but I should be able to look at it sometime this week.

The problem seems to be in process_cleanup_with_session_management_support, where clear_persistent_model_associations is actually called.

For some reason, it's called after the session is saved, instead of before, where it would actually make a difference.

Patch is being uploaded.

Please reopen with a patch and unit tests if this remains an issue.

Let's try this again. I'm attaching two files:

The first one adds a test that fails because of the discussed in this ticket. The patch also modifies TestSession in order to make it functional enough to mimic the behaviour we're looking for.

The second file one adds support for clear_persistent_model_associations in all session stores (by not looking for @data but rather using a 'data' method), including the TestSession (not really a 'session store', but you get the idea). This patch is needed for the original patch to pass the tests. Otherwise, only ARSessionStore sessions can pass the test.

So, apply test-4795.patch, run tests and see how they fail. Then apply 4795.patch and clear_persistent_in_all_stores.patch. Run tests. See how they run.

Test this bug

Additional patch needed to test the original fix. Also provides "extra" features

Good work. I have one test failure:

  1) Failure:
test_process_cleanup_with_session_management_support(SessionManagementTest) [./test/controller/session_management_test.rb:143]:
<"does not have cached associations"> expected but was
<"has cached associations">.

Just needed TestSession#data.

(In [5512]) Always clear model associations from session. Closes #4795.

The extra features in my original patch, actually needed for the test itself, broke the original feature of clearing the caches on active_record based sessions.

The feature enabled the "clearing" on all other session stores, but it actually broke it on AR stores.

This additional patch (fix_clear_persistent_in_ar_stores.patch) fixes that problem.

Thanks!

(In [5531]) ARStore needs a data reader method. Closes #4795.