Login and logout flow in Ruby on Rails - Step-by-Step Execution

Concept Flow - Login and logout flow

User visits login page

↓

User submits credentials

↓

Check credentials

↓

Create session

↓

Redirect to [Stay on login page

↓

User clicks logout

↓

Destroy session

↓

Redirect to login page

This flow shows how a user logs in by submitting credentials, the system checks them, creates a session if valid, and logs out by destroying the session.

Execution Sample

Ruby on Rails

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to dashboard_path
  else
    render :new
  end
end

def destroy
  session.delete(:user_id)
  redirect_to login_path
end

This code handles login by checking user credentials and setting session, and logout by clearing session and redirecting.

Execution Table

Step	Action	Input	Condition	Result	Next Step
1	User visits login page	N/A	N/A	Login form displayed	User submits credentials
2	User submits credentials	email: [e-mail], password: secret	N/A	Credentials received	Check credentials
3	Check credentials	email and password	User exists and password correct?	True	Create session
4	Create session	user.id = 1	N/A	session[:user_id] = 1	Redirect to dashboard
5	Redirect to dashboard	N/A	N/A	Dashboard page shown	User clicks logout
6	User clicks logout	N/A	N/A	Logout requested	Destroy session
7	Destroy session	N/A	N/A	session[:user_id] deleted	Redirect to login page
8	Redirect to login page	N/A	N/A	Login form displayed again	End

💡 User logs out, session cleared, redirected to login page, flow ends.

Variable Tracker

Variable	Start	After Step 4	After Step 7
session[:user_id]	nil	1	nil
user	nil	User object with id=1	User object with id=1 (no change)

Key Moments - 3 Insights

Why does the session[:user_id] get set only after checking credentials?

Because setting session[:user_id] means the user is logged in. We only do this after confirming the user exists and the password is correct, as shown in step 3 and 4 of the execution_table.

What happens if the credentials are invalid?

The flow does not create a session or redirect to dashboard. Instead, it renders the login form again, as implied by the 'Invalid' branch in the concept_flow and step 3 condition being false.

Why do we delete session[:user_id] on logout?

Deleting session[:user_id] removes the user's login state, effectively logging them out. This is shown in step 7 of the execution_table.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of session[:user_id] after step 4?

A 1

B nil

C user object

D undefined

💡 Hint

Check the variable_tracker row for session[:user_id] after step 4.

At which step does the system check if the user credentials are valid?

A Step 2

B Step 4

C Step 3

D Step 6

💡 Hint

Look at the 'Condition' column in the execution_table.

If the user enters wrong password, what happens according to the flow?

A session[:user_id] is set to nil

B Login form is shown again

C User is redirected to dashboard

D Session is deleted

💡 Hint

Refer to the concept_flow and the 'Invalid' branch after checking credentials.

Concept Snapshot

Login and logout flow in Rails:
- User submits email and password
- System checks credentials
- If valid, session[:user_id] is set
- Redirect to dashboard
- Logout clears session[:user_id]
- Redirect back to login page

Full Transcript

This visual execution shows the login and logout flow in a Rails app. The user visits the login page and submits credentials. The system checks if the user exists and the password matches. If valid, it sets session[:user_id] to log the user in and redirects to the dashboard. If invalid, it shows the login form again. When the user clicks logout, the session[:user_id] is deleted to log out, and the user is redirected to the login page. Variables like session[:user_id] change state only after successful login and are cleared on logout.

Practice

1. What does the session[:user_id] typically store in a Rails login flow?

easy

A. The user's email address

B. The ID of the logged-in user

C. The user's password

D. The current time of login

Solution

1. Step 1: Understand session usage in Rails login

   In Rails, session[:user_id] is used to store the unique identifier of the logged-in user to keep track of their session.

2. Step 2: Differentiate from other user data

   Passwords and emails are not stored in session for security and privacy reasons; only the user ID is stored.

3. Final Answer:

   The ID of the logged-in user -> Option B

4. Quick Check:

   session[:user_id] = user ID [OK]

Hint: Session stores user ID, not password or email [OK]

Common Mistakes:

• Thinking session stores password
• Confusing session with cookies
• Assuming session stores full user object

2. Which of the following is the correct way to clear the user session during logout in a Rails controller?

easy

A. reset_session

B. session.clear

C. session[:user_id] = nil

D. session.delete(:user_id)

Solution

1. Step 1: Identify Rails method to reset session

   The reset_session method clears the entire session safely and is the recommended way to log out a user.

2. Step 2: Compare with other options

   While session.delete(:user_id) or setting it to nil removes the user ID, reset_session is more secure as it resets the whole session.

3. Final Answer:

   reset_session -> Option A

4. Quick Check:

   Use reset_session to clear all session data [OK]

Hint: Use reset_session to fully clear session on logout [OK]

Common Mistakes:

• Only deleting user_id but leaving other session data
• Using session.clear, which doesn't regenerate the session ID
• Setting session[:user_id] to nil without resetting session

3. Given this Rails controller code for login:

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to dashboard_path
  else
    flash[:alert] = 'Invalid login'
    render :new
  end
end

What happens if the password is incorrect?

medium

A. User is redirected to dashboard

B. User ID is saved in session

C. Application crashes with error

D. Login form is re-rendered with alert

Solution

1. Step 1: Analyze the if condition

   The condition user&.authenticate(params[:password]) returns false if password is wrong, so the else block runs.

2. Step 2: Understand else block behavior

   The else block sets a flash alert and re-renders the login form with render :new.

3. Final Answer:

   Login form is re-rendered with alert -> Option D

4. Quick Check:

   Wrong password triggers else block [OK]

Hint: Wrong password triggers else block with alert [OK]

Common Mistakes:

• Assuming redirect happens on wrong password
• Thinking session is set even if password fails
• Believing app crashes on wrong password

4. Identify the error in this logout action:

def destroy
  session[:user_id] = nil
  redirect_to login_path
end

What is the main issue with this logout method?

medium

A. It does not clear the entire session

B. It redirects to the wrong path

C. It raises a syntax error

D. It does not delete the user record

Solution

1. Step 1: Check session clearing method

   Setting session[:user_id] = nil only removes the user ID but leaves other session data intact.

2. Step 2: Understand best practice for logout

   Best practice is to use reset_session to clear all session data and prevent session fixation attacks.

3. Final Answer:

   It does not clear the entire session -> Option A

4. Quick Check:

   Partial session clearing is insecure [OK]

Hint: Partial session clearing leaves data behind; use reset_session [OK]

Common Mistakes:

• Thinking setting user_id to nil clears session fully
• Ignoring session fixation security risks
• Assuming redirect path affects logout correctness

5. You want to ensure users cannot access the dashboard without logging in. Which code snippet correctly enforces this in a Rails controller using the login session?

hard

A. before_action :require_login

def require_login
redirect_to login_path if session[:user_id].present?
end

B. before_action :require_login

def require_login
redirect_to dashboard_path if session[:user_id].nil?
end

C. before_action :require_login

def require_login
redirect_to login_path unless session[:user_id]
end

D. before_action :require_login

def require_login
redirect_to login_path if session[:user_id] == true
end

Solution

1. Step 1: Understand login check logic

   Users should be redirected to login if session[:user_id] is missing (nil or false).

2. Step 2: Analyze each option's condition

   before_action :require_login def require_login redirect_to login_path unless session[:user_id] end redirects to login unless user_id exists, correctly blocking access. Others have incorrect conditions or redirect to wrong paths.

3. Final Answer:

   before_action :require_login with redirect unless session[:user_id] -> Option C

4. Quick Check:

   Redirect to login if no user_id [OK]

Hint: Redirect unless session[:user_id] exists to block access [OK]

Common Mistakes:

• Using wrong condition logic for session check
• Redirecting to dashboard instead of login
• Checking session[:user_id] == true which is incorrect