Removing cookies messes up with flash

[blarralde]

The notices/alerts I set in the flash are somehow persisted across requests when cookies are unset, whether it's through use of a before_filter or rack middleware. The result is that the same message is shown over and over, until the user reaches an action that doesn't remove cookies.

[blarralde]

I went around the issue by adding if flash.empty? to request.session_options[:skip] = true in both controller methods. That way the browser receives the instruction to clear the flash from the cookie. This has the double advantage of setting a Set-Cookie header, which tells fastly uses to not cache the page. End result: pages with a flash are not cached, yeay!

If anybody has any cleaner way of dealing with this, please let me know!

[iandoesallthethings]

When we tried to use @blarralde's approach, we ran into a problem where the cache would repeatedly miss after a flash message was shown. We solved the whole issue using AJAX, but ESI could accomplish something similar. Our approach was inspired by this article: https://www.fastly.com/blog/caching-uncacheable-csrf-security

We extracted the flashes to an api endpoint called /flashes.json and built a controller for it.

# app/controllers/flashes_controller.rb
class FlashesController < ApplicationController
  def index
    f = flash.to_json
    flash.clear # to prevent duplicate flashes
    respond_to do |format|
      format.json do
        render json: f
      end
    end
  end
end

# in app/views/shared/_ajax_flashes.html.erb
$ ->
  $.get("/flashes.json", (messages) ->
    return if not messages
    messages.forEach (message) ->
      displayMessage(message)
  )

# in app/views/layouts/application.html.erb
<%= render 'shared/ajax_flashes' %>

We then created a request setting in Fastly to always pass on /flashes.json, and the issue was solved!