Question

I am assigning an entire user object to be held in the session…Is this bad? How does rails store session data? I have a feeling this is a bad idea. Should I just store the user_id in the session?

module SessionsHelper
  def sign_in(user)
    session[:user] = user
  end

  def current_user
    session[:user]
  end

  def sign_out
    session[:user] = nil
  end
end

EDIT (I think this is better)

module SessionsHelper
  def sign_in(employee)
    session[:employee_id] = employee.id
    @employee = employee
  end

  def current_employee
    if session[:employee_id]
      @employee||=Employee.first(session[:employee])
    end
  end

  def sign_out
    session[:employee_id] = nil
    @employee = nil
  end
end

Answer 1

The default session storage is CookieStore, which has a 4 KB size limit. So depending on the size of your user object, this could be a bad idea. You may not be able to fit all of the information in the cookie, especially given other content may be stored in the cookie.

Also, I’d recommend putting as little information as you can get away with in the cookie session to lower the size of your user’s requests/responses. The cookies will be sent over with each new request/response, at least until you nil them out, so it adds to the overall size of each.