Problems with Siege, Sessions, and Rails 2
Sep 10th, 2008 by Austin Mills
So, if you were going to do some load-testing on your Rails app, you might think, hey, Siege is pretty cool. It supports load-testing multiple URLs at once (either sequential or in random order), with a delay in-between, with lots of options for setting the duration and characteristics of the load. Plus, there’s a tool that works with Siege, Sproxy, that lets you generate that list of URLs automatically by using Sproxy as a web proxy, recording your actions on the site.
Siege doesn’t support sessions (of course, that’s not clear from the docs, but I assure you it’s the case), which at first might be a deal-breaker if your app handles security by authenticating the session… but then you remember that you can pass in the _session_id parameter, and think all will be well.
Complication #1: In recent Rails versions, the session id can only be pulled from the cookie. However, we remember that you can set
ActionController::CgiRequest::DEFAULT_SESSION_OPTIONS[:cookie_only] = false
And allow the session id to be taken from the parameter as well. However, if you’re running Rails 2, this won’t work. See Complication #2.
Complication #2: Thanks to a fix intended to prevent session fixation attacks, but which had some unintended consequences, the ability to override the cookie_only setting is broken. There is a monkey patch attached as a comment to that bug, but that’s not something I want to do when load-testing code. I do feel bad for the people out there (mainly mobile browsers and other non-traditional clients) that depend on parameter-passed session IDs.
So, time to look for a new tool, initial candidates are httperf/autobench, Flood, ab, and Tsung.
Thanks to JL2003 for the image.