Login and logout flow in Ruby on Rails

Introduction

Login and logout let users enter and leave your app safely. It keeps their info private and controls access.

When you want users to have personal accounts.

When you need to protect parts of your app from strangers.

When you want to remember who is using the app.

When you want to let users end their session securely.

Syntax

Ruby on Rails

class SessionsController < ApplicationController
  def new
    # shows login form
  end

  def create
    user = User.find_by(email: params[:email])
    if user&.authenticate(params[:password])
      session[:user_id] = user.id
      redirect_to root_path, notice: 'Logged in!'
    else
      flash.now[:alert] = 'Invalid email or password'
      render :new
    end
  end

  def destroy
    session[:user_id] = nil
    redirect_to login_path, notice: 'Logged out!'
  end
end

The session hash stores user info between requests.

authenticate checks the password securely.

Examples

This saves the logged-in user's ID in the session to remember them.

Ruby on Rails

session[:user_id] = user.id

This clears the session to log the user out.

Ruby on Rails

session[:user_id] = nil

This finds the user by email and checks the password.

Ruby on Rails

user = User.find_by(email: params[:email])
if user&.authenticate(params[:password])
  # login success
else
  # login fail
end

Sample Program

This code shows a simple login form, a controller to handle login and logout, and routes to connect URLs.

Ruby on Rails

# app/controllers/sessions_controller.rb
class SessionsController < ApplicationController
  def new
    # renders login form
  end

  def create
    user = User.find_by(email: params[:email])
    if user&.authenticate(params[:password])
      session[:user_id] = user.id
      redirect_to root_path, notice: 'Logged in!'
    else
      flash.now[:alert] = 'Invalid email or password'
      render :new
    end
  end

  def destroy
    session[:user_id] = nil
    redirect_to login_path, notice: 'Logged out!'
  end
end

# app/views/sessions/new.html.erb
<%= form_with url: login_path, method: :post do %>
  <div>
    <label for="email">Email:</label>
    <%= text_field_tag :email, nil, id: 'email', required: true %>
  </div>
  <div>
    <label for="password">Password:</label>
    <%= password_field_tag :password, nil, id: 'password', required: true %>
  </div>
  <div>
    <%= submit_tag 'Log in' %>
  </div>
<% end %>

# config/routes.rb
Rails.application.routes.draw do
  get '/login', to: 'sessions#new'
  post '/login', to: 'sessions#create'
  delete '/logout', to: 'sessions#destroy'
  root 'welcome#index'
end

Important Notes

Always use has_secure_password in your User model to handle password safely.

Use flash messages to show login success or failure clearly.

Protect pages by checking if session[:user_id] exists before allowing access.

Summary

Login saves user ID in session to remember them.

Logout clears session to end user access.

Use controller actions to handle login form, authentication, and logout.