Login and logout flow in Ruby on Rails - Step-by-Step Execution

Concept Flow - Login and logout flow

User visits login page

↓

User submits credentials

↓

Check credentials

↓

Create session

↓

Redirect to [Stay on login page

↓

User clicks logout

↓

Destroy session

↓

Redirect to login page

This flow shows how a user logs in by submitting credentials, the system checks them, creates a session if valid, and logs out by destroying the session.

Execution Sample

Ruby on Rails

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to dashboard_path
  else
    render :new
  end
end

def destroy
  session.delete(:user_id)
  redirect_to login_path
end

This code handles login by checking user credentials and setting session, and logout by clearing session and redirecting.

Execution Table

Step	Action	Input	Condition	Result	Next Step
1	User visits login page	N/A	N/A	Login form displayed	User submits credentials
2	User submits credentials	email: [e-mail], password: secret	N/A	Credentials received	Check credentials
3	Check credentials	email and password	User exists and password correct?	True	Create session
4	Create session	user.id = 1	N/A	session[:user_id] = 1	Redirect to dashboard
5	Redirect to dashboard	N/A	N/A	Dashboard page shown	User clicks logout
6	User clicks logout	N/A	N/A	Logout requested	Destroy session
7	Destroy session	N/A	N/A	session[:user_id] deleted	Redirect to login page
8	Redirect to login page	N/A	N/A	Login form displayed again	End

💡 User logs out, session cleared, redirected to login page, flow ends.

Variable Tracker

Variable	Start	After Step 4	After Step 7
session[:user_id]	nil	1	nil
user	nil	User object with id=1	User object with id=1 (no change)

Key Moments - 3 Insights

Why does the session[:user_id] get set only after checking credentials?

Because setting session[:user_id] means the user is logged in. We only do this after confirming the user exists and the password is correct, as shown in step 3 and 4 of the execution_table.

What happens if the credentials are invalid?

The flow does not create a session or redirect to dashboard. Instead, it renders the login form again, as implied by the 'Invalid' branch in the concept_flow and step 3 condition being false.

Why do we delete session[:user_id] on logout?

Deleting session[:user_id] removes the user's login state, effectively logging them out. This is shown in step 7 of the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of session[:user_id] after step 4?

A 1

B nil

C user object

D undefined

💡 Hint

Check the variable_tracker row for session[:user_id] after step 4.

At which step does the system check if the user credentials are valid?

A Step 2

B Step 4

C Step 3

D Step 6

💡 Hint

Look at the 'Condition' column in the execution_table.

If the user enters wrong password, what happens according to the flow?

A session[:user_id] is set to nil

B Login form is shown again

C User is redirected to dashboard

D Session is deleted

💡 Hint

Refer to the concept_flow and the 'Invalid' branch after checking credentials.

Concept Snapshot

Login and logout flow in Rails:
- User submits email and password
- System checks credentials
- If valid, session[:user_id] is set
- Redirect to dashboard
- Logout clears session[:user_id]
- Redirect back to login page

Full Transcript

This visual execution shows the login and logout flow in a Rails app. The user visits the login page and submits credentials. The system checks if the user exists and the password matches. If valid, it sets session[:user_id] to log the user in and redirects to the dashboard. If invalid, it shows the login form again. When the user clicks logout, the session[:user_id] is deleted to log out, and the user is redirected to the login page. Variables like session[:user_id] change state only after successful login and are cleared on logout.