Question

In my web app after a user logs in a new session is created so until he closes the browser he stays logged in. The problem appears when admin wants to ban the user who’s browser is still open. Even though the user is banned and cannot log in anymore, he still stays logged in until he closes the browser or manually logs out. This definitely should be fixed.

Is it possible to add a verifying method to every action of every controller? Of course I mean a smart way – not copy/paste 100 times.

Answer 1

add the following to your application controller:

before_filter :sign_out_banned_user

def sign_out_banned_user
  if current_user.banned?
    session[:current_user_id] = nil
    redirect_to root_path, :notice => "You are banned"
    return false
  end
end