Login and logout flow in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after a successful login in a Rails app?

Consider a typical Rails login controller action that authenticates a user and sets a session. What is the expected behavior immediately after a successful login?

Ruby on Rails

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to dashboard_path
  else
    flash.now[:alert] = "Invalid email or password"
    render :new
  end
end

A The user ID is stored in the session and the browser is redirected to the dashboard page.

B The user ID is stored in a cookie and the login form is re-rendered.

C The user ID is stored in a global variable and the user is redirected to the login page.

D The user ID is stored in the session and the login form is re-rendered with an error.

💡 Hint

Think about what happens when login is successful: where is the user ID stored and what does the app do next?

On successful login, Rails stores the user ID in the session hash and redirects the user to a protected page like the dashboard. This keeps the user logged in across requests.

❓ state_output

intermediate

What is the session state after logout?

Given this logout action in a Rails controller, what will be the state of session[:user_id] after it runs?

Ruby on Rails

def destroy
  session.delete(:user_id)
  redirect_to root_path
end

A session[:user_id] will be set to false.

B session[:user_id] will be nil or undefined.

C session[:user_id] will still hold the user ID.

D session[:user_id] will raise an error if accessed.

💡 Hint

Deleting a key from the session removes it. What does that mean when you try to read it later?

Calling session.delete(:user_id) removes the key from the session hash, so accessing session[:user_id] returns nil.

📝 Syntax

advanced

Identify the syntax error in this login method

Which option contains the correct syntax for authenticating a user in Rails?

Ruby on Rails

def login
  user = User.find_by(email: params[:email])
  if user.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to root_path
  else
    render :new
  end
end

A if user.authenticate(params[:password])

B if user | user.authenticate(params[:password])

C if user && user.authenticate(params[:password])

D if user&.authenticate(params[:password])

💡 Hint

Consider what happens if user is nil. How to safely call authenticate?

Using the safe navigation operator &. prevents calling authenticate on nil, avoiding a NoMethodError.

🔧 Debug

advanced

Why does this logout action fail to clear the session?

Given this logout method, why does the user remain logged in after logout?

Ruby on Rails

def logout
  session[:user_id] == nil
  redirect_to root_path
end

A Because <code>redirect_to</code> must come before session changes.

B Because <code>session.clear</code> is required to clear the session.

C Because <code>session[:user_id] == nil</code> is a comparison, not an assignment.

D Because the session key must be set to false, not nil.

💡 Hint

Look carefully at the line that tries to clear the session key. Is it doing what you expect?

The code uses == which compares values but does not assign. To clear the session key, use = nil or session.delete(:user_id).

🧠 Conceptual

expert

What is the main security benefit of resetting the session on logout?

In Rails, calling reset_session during logout is recommended. Why is this important?

A It prevents session fixation attacks by generating a new session ID.

B It logs the user out from all devices automatically.

C It encrypts the session data to protect user information.

D It speeds up the logout process by clearing cookies faster.

💡 Hint

Think about what happens if an attacker steals a session ID before logout.

Resetting the session creates a new session ID, preventing attackers from reusing an old session ID (session fixation). This improves security.