Rails session cookie migrator

session_cookie_migrator.rb

# frozen_string_literal: true

# In order to support single-sign-on we need to update the session cookie to include a "domain" attribute. However,
# if we leave the cookie name the same the browser will end up with 2 cookies with the same name but different values.
# When the browser sends both these cookies Rails will only use one of them, and if it chooses the wrong one the
# user will be logged out and won't be able to log back in again!
#
# The solution is to change the name of the session cookie, but this will automatically log everyone out. To avoid that
# we insert this rack middlware that will modify the request and duplicate the old session cookie with the new name if
# not present.
#
# Add this line to application.rb to insert the middleware:
#
# config.middleware.insert_before(ActionDispatch::Cookies, SessionCookieMigrator)
#
# This middleware is only needed temporarily and can be removed after a day or two once all users are using the new
# session cookie.
class SessionCookieMigrator
  def initialize(app)
    @app = app
  end

  def call(env)
    Rack::Request.new(env).cookies
    cookie_hash = env[Rack::RACK_REQUEST_COOKIE_HASH]
    if cookie_hash && cookie_hash["_my_app_#{Rails.env}_session"].present?
      cookie_hash["_my_app_#{Rails.env}_session_sso"] ||= cookie_hash["_my_app_#{Rails.env}_session"]
    end

    @app.call(env)
  end
end