26

Why should we avoid using class variables @@ in rails? Is there any security loopholes with that. Please answer as I am new with rails. and I am much using instance variable @variable_name . I tried once @@variable_name .

I know only about class variable is, Class variable is sharable between object

But I really would like to know Why should we avoid using class variables @@ in rails?

Improve this question
1
  • That sounds like static variables in Java. No reason not to use it, just be aware that it doesn't belong to your instance and could change asynchronously. Commented Oct 13, 2013 at 3:33

1 Answer 1

Reset to default
51

Simply because they are not thread safe. Many rails=capable servers are multi-threaded. That means there may be multiple running instances of your application at any given time and any request by one of your users is going to be arbitrarily assigned to one of them. Class variables are not shared between processes so there is a possibility that your class variable will be different in a subsequent request.

Even if you deliberately manage to run your app in a single threaded server, there is no guarantee that your app won't be restarted between requests, losing your class variable.

If you want functionality similar to what class variables provide, I strongly recommend that you look into key-value stores such as Memcached or Redis.

Improve this answer
Sign up to request clarification or add additional context in comments.

8 Comments

Nothing is shared between processes, not just @@vars. Guess we shouldn't use @vars also for the same reason, should we?
@Victor Well, @variables are instance variables and they are consistent within a request because a request spawns a new instance of a controller. Just don't expect to find them in the next request.
@edgerunner @@vars are not about sharing between requests, but about sharing between instances of the same class (and subclasses in this particularly case which makes them a bit dangerous unless you know what you are doing). Check e.g. ActiveRecord, ActiveSupport -- @@vars are still there as of 3.1.3
@edgerunner I didn't realize somebody would use @@vars for saving state (OP didn't indicate that). Guess besides Memcached or Redis we usually use session in Rails for that purpose. At the same time when properly initialized @@vars (as well as class-level @vars) are quite safe both in production and development mode, e.g. for storing values persistent in this particular rails process.
@MichaeldeSilva Simple example right here: You could use a class variable to store the value of an API token that you would request from an external service during startup. Then that API token is available to the class all through the run time and it can be updated when it times out. It is independent of any user's session or any single request.
|

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.