Rails cookie writing settings - domains/subdomains, URL-encoding

[anselmbradford]

A few questions:

• Can and should the domain in https://github.com/codeforamerica/ohana-web-search/blob/master/app/controllers/concerns/google_translator.rb#L13 use :all like is done in the cookie delete method? I thought I remember reading somewhere that the domain on the cookie creation and deletion should be the same. It appears to work the way it is, but using :all would eliminate the environment variable call.

• Google Translate adds two cookies. Running the app locally these are on the domains .lvh.me and lvh.me. The Rails code in https://github.com/codeforamerica/ohana-web-search/blob/master/app/controllers/concerns/google_translator.rb#L11-L14 only overwrites one of these. The current method:

  cookies[:googtrans] = {
    value: "/en/#{params[:translate]}",
    domain: "#{ENV['DOMAIN_NAME']}"
  }

  ...can be interchanged with...

  cookies[:googtrans] = "/en/#{params[:translate]}"

  ...to selectively overwrite the cookie at lvh.me and .lvh.me. However, I can't figure out how to use both these methods of writing cookies at the same time. When they are both present, one gets ignored. We're overwriting the cookies on the client, but it would be preferable if they were overwritten on the server.

• Google Translate's cookies don't have URL-encoded values, whereas the ones Rails writes are, so /en/es becomes %2Fen%2Fes. This seems okay, because once the page reloads the Google Translate Widget overwrites these with the non-URL-encoded values, but if it is easy to prevent Rails from URL-encoding these values it may be worth doing so that the output values are the same as Google's.

[monfresh]

I don't know the answers off the top of my head, but you could answer them by testing the app with different settings for domain, and with only using server-based cookie deletion, or only client-based, or both. Did you try setting domain to :all to see if it still works?

[anselmbradford]

My preliminary test on lvh.me had :all working the same as "#{ENV['DOMAIN_NAME']}", but both don't hit both .lvh.me and lvh.me, which Google does with their script. It would still need to be tested on a heroku deploy as well.