title: Adding sessions and session_store back into a Rails 5 API (sessions not persisting)
body: <p>I am attempting to set up a basic sessions-based authentication strategy in a Rails 5 API. </p>
  
  <p>I think I'm mostly running into a configuration confusion, because a new session is generated on each request. </p>
  
  <p>I've added the cookies and cookie store middleware back into the application</p>
  
  <p><code>config/application.rb</code></p>
  
  <pre><code>  class Application &lt; Rails::Application
          # Settings in config/environments/* take precedence over those specified here.
          # Application configuration should go into files in config/initializers
          # -- all .rb files in that directory are automatically loaded.
  
          # Only loads a smaller set of middleware suitable for API only apps.
          # Middleware like session, flash, cookies can be added back manually.
          # Skip views, helpers and assets when generating a new resource.
          config.middleware.use ActionDispatch::Cookies
          config.middleware.use ActionDispatch::Session::CookieStore
  
          config.api_only = false
        end
  </code></pre>
  
  <p>It seems like I have to set api_only to false or I get <code>#&lt;ActionDispatch::Request::Session:0x7fd40b2eec80 not yet loaded&gt;</code></p>
  
  <p>I added the session_store initializer and the cookie_serializer:</p>
  
  <p><code>config/initializers/session_store.rb</code></p>
  
  <pre><code>Rails.application.config.session_store :cookie_store, key: '_tunr_sol_json_api_session'
  </code></pre>
  
  <p><code>config/initializers/cookie_serializer.rb</code></p>
  
  <pre><code>Rails.application.config.action_dispatch.cookies_serializer = :json
  </code></pre>
  
  <p>I'm not storing sessions in the database. </p>
  
  <p>I have a sessions controller that sets a current_user_id key to the sessions object when the user is successfully authenticated.</p>
  
  <p><code>app/controllers/sessions_controller.rb</code></p>
  
  <pre><code>class SessionsController &lt; ApplicationController
    def create
      user = User.find_by(username: params[:user][:username])
      if user &amp;&amp; user.authenticate(params[:user][:password])
        session[:current_user_id] = user.id
        render json: {status: 201, message: "session created", user: user}
      else
        render json: {status: 401, message: "unauthorized"}
      end
    end
  
    def destroy
      session[:current_user_id] = nil
      render json: {status: 204, message: "no content"}
    end
  end
  </code></pre>
  
  <h2>The behavior</h2>
  
  <p>The auth strategy I have set up with bcrypt and has_secure_password works. And in looking at the session in sessions#create it successfully sets the user id to the session.</p>
  
  <p><a href="https://i.stack.imgur.com/YXgiM.png" rel="noreferrer"><img src="https://i.stack.imgur.com/YXgiM.png" alt="sessions#create"></a></p>
  
  <p>But the session doesn't seem to persist or get stored in the browser. sessionStorage after login has a length of 0</p>
  
  <p>When I log out and check the session, it creates a new session.</p>
  
  <p><a href="https://i.stack.imgur.com/Qqzde.png" rel="noreferrer"><img src="https://i.stack.imgur.com/Qqzde.png" alt="sessions#destroy"></a> </p>
  
  <h2>Question</h2>
  
  <p>Not sure what configuration I'm missing or have wrong to get this functionality set up with the api.</p>