Question

I store all session information in database. The user can login the system for do something. There are some restricted area required user login. If the user try to reach those area before login, the system will redirect them to login page.

Sometimes user may close the browser without logout. If this happen, next time when he try to login, the system cannot recognized the newly generate session, even the user typed in the correct username and password. The system will then force the user login again.

Would anyone know how to fix this? I tried to reset the session using reset_session before loading the login page. The problem cannot be fixed.

Session Controller

  def new
  end

  def create
    session[:current_account] = Account.authenticate(params[:email], params[:password])
    if session[:current_account]
      redirect_to :controller => "xxxxx", :action => "index"
    else
      flash[:notice] = "Please try again."
      render :action => 'new'
    end
  end

Account Model

  def self.authenticate(email, pass)
    account = find_by_email(email)
    account && account.authenticated?(pass) ? account : nil
  end

  def authenticated?(pass)
    encrypted_password == Account.encrypt(pass,salt)
  end

Xxxxx Controller

  before_filter :permission_handling

  def index
  end

Application Controller

  def permission_handling
    unless logged_in?
      forced_login
    end
  end

  def logged_in?
    session[:current_account].is_a?(Account)
  end

  def forced_login
    flash[:notice] = "You haven't login yet!"
    redirect_to ( :controller => "sessions", :action => "new" )
  end

Thanks all. 🙂

Answer 1

It looks like you’re storing an Account object in the session. This is not recommended: you should store just simple values, like the account id in session.

Change Model.authenticate to return account.id, and check logged_in by loading the account from the database instead of keeping it in the session.

I’m not sure if this fully addresses the problem though, but it might be significant.