Session handling in Ruby on Rails - Step-by-Step Execution

Concept Flow - Session handling

User sends HTTP request

↓

Rails receives request

↓

Check for session cookie

↓

Load session

↓

Controller action runs

↓

Modify session data?

↓

Send response with session cookie

↓

User browser stores cookie

Rails checks for a session cookie in the request. If found, it loads session data; if not, it creates a new session. Controller actions can read or write session data, then Rails sends a response with updated session info.

Execution Sample

Ruby on Rails

class ApplicationController < ActionController::Base
  def login
    session[:user_id] = params[:id]
    render plain: "Logged in as #{session[:user_id]}"
  end
end

This code saves a user ID in the session and shows a confirmation message.

Execution Table

Step	Request Detail	Session Cookie Present?	Session Data Before	Action	Session Data After	Response Sent
1	User sends login request with id=42	No	{}	Create new session, set session[:user_id] = 42	{user_id: 42}	Response with cookie and message 'Logged in as 42'
2	User sends another request with session cookie	Yes	{user_id: 42}	Read session[:user_id]	{user_id: 42}	Response with cookie and message 'Logged in as 42'
3	User sends logout request clearing session	Yes	{user_id: 42}	Clear session data	{}	Response with cleared cookie

💡 Session ends when user logs out or session expires, no session cookie sent.

Variable Tracker

Variable	Start	After Step 1	After Step 2	After Step 3
session[:user_id]	nil	42	42	nil

Key Moments - 3 Insights

Why does the session data persist between requests?

Because Rails sends a session cookie to the browser in the response (see Step 1), which the browser sends back in the next request (Step 2), allowing Rails to load the saved session data.

What happens if the user has no session cookie?

Rails creates a new empty session (Step 1), so session data starts fresh. This is shown in the first row where session is empty before setting user_id.

How does Rails clear session data on logout?

The controller action clears session data (Step 3), and Rails sends a response that instructs the browser to remove the session cookie, ending the session.

Visual Quiz - 3 Questions

Look at the execution table, what is the value of session[:user_id] after Step 1?

A {}

B nil

C 42

D undefined

💡 Hint

Check the 'Session Data After' column in Step 1.

At which step does Rails create a new session because no cookie is present?

A Step 2

B Step 1

C Step 3

D None

💡 Hint

Look at the 'Session Cookie Present?' column and find where it says 'No'.

If the user clears cookies manually, what will happen on the next request?

A Rails will create a new session

B Rails will load old session data

C Rails will throw an error

D Session data will be unchanged

💡 Hint

Refer to the flow where no session cookie means a new session is created.

Concept Snapshot

Session handling in Rails:
- Rails uses cookies to track sessions.
- On request, Rails checks for session cookie.
- If none, creates new session.
- Controller can read/write session[:key].
- Response sends updated cookie.
- Session persists across requests via cookie.

Full Transcript

In Rails, session handling works by using cookies to remember user data between requests. When a user sends a request, Rails looks for a session cookie. If it finds one, it loads the saved session data. If not, it creates a new session. Controller actions can store or read data in the session hash, like session[:user_id]. After processing, Rails sends a response that includes the session cookie so the browser can keep it. This way, the session data persists across multiple requests. When the user logs out, the session data is cleared and the cookie is removed, ending the session.