Session-based authentication in Ruby on Rails

Introduction

Session-based authentication helps websites remember who you are after you log in. It keeps you signed in while you browse.

When you want users to log in and stay logged in while using your website.

When you need to protect parts of your site so only signed-in users can see them.

When you want to track user activity during a visit without asking them to log in every time.

When building a simple web app that needs user accounts without complex token systems.

Syntax

Ruby on Rails

class SessionsController < ApplicationController
  def create
    user = User.find_by(email: params[:email])
    if user&.authenticate(params[:password])
      session[:user_id] = user.id
      redirect_to root_path, notice: 'Logged in successfully'
    else
      flash.now[:alert] = 'Invalid email or password'
      render :new
    end
  end

  def destroy
    session.delete(:user_id)
    redirect_to root_path, notice: 'Logged out successfully'
  end
end

Use session[:key] to store or access session data.

Sessions are stored on the server, and the browser keeps a cookie to identify the session.

Examples

Stores the logged-in user's ID in the session to remember them.

Ruby on Rails

session[:user_id] = user.id

Removes the user ID from the session to log the user out.

Ruby on Rails

session.delete(:user_id)

Fetches the current logged-in user using the ID stored in the session.

Ruby on Rails

current_user = User.find_by(id: session[:user_id])

Sample Program

This example shows a simple session-based login system. The SessionsController handles logging in and out. The ApplicationController has a helper method to get the current user and a method to protect pages that need login.

Ruby on Rails

class SessionsController < ApplicationController
  def new
    # Shows login form
  end

  def create
    user = User.find_by(email: params[:email])
    if user&.authenticate(params[:password])
      session[:user_id] = user.id
      redirect_to root_path, notice: 'Logged in successfully'
    else
      flash.now[:alert] = 'Invalid email or password'
      render :new
    end
  end

  def destroy
    session.delete(:user_id)
    redirect_to root_path, notice: 'Logged out successfully'
  end
end

class ApplicationController < ActionController::Base
  helper_method :current_user

  def current_user
    @current_user ||= User.find_by(id: session[:user_id])
  end

  def authenticate_user!
    redirect_to login_path, alert: 'Please log in' unless current_user
  end
end

Important Notes

Sessions rely on cookies, so users must have cookies enabled in their browser.

Always use secure cookies (HTTPS) in production to protect session data.

Do not store sensitive data directly in the session; store only user IDs or tokens.

Summary

Session-based authentication remembers users by storing their ID in a server-side session.

Use session[:user_id] to track logged-in users.

Clear the session to log users out safely.

Practice

1. What does session[:user_id] typically store in a Rails application using session-based authentication?

easy

A. The user's password

B. The user's email address

C. The ID of the currently logged-in user

D. The entire user object

Solution

1. Step 1: Understand session usage in Rails

   Rails uses the session hash to store small pieces of data between requests, commonly the user ID for authentication.

2. Step 2: Identify what session[:user_id] holds

   This key stores the unique identifier of the logged-in user to recognize them on subsequent requests.

3. Final Answer:

   The ID of the currently logged-in user -> Option C

4. Quick Check:

   session[:user_id] = user ID [OK]

Hint: Remember session stores user ID, not full user data [OK]

Common Mistakes:

• Thinking session stores full user object
• Confusing user ID with password or email
• Assuming session is client-side storage

2. Which of the following is the correct way to log out a user by clearing the session in a Rails controller?

easy

A. session.clear

B. All of the above

C. session[:user_id] = nil

D. session.delete(:user_id)

Solution

1. Step 1: Review methods to clear session data

   In Rails, you can remove session data by clearing all keys, deleting a specific key, or setting a key to nil.

2. Step 2: Confirm all options effectively log out user

   All three methods remove the user ID from session, effectively logging out the user.

3. Final Answer:

   All of the above -> Option B

4. Quick Check:

   Any method removing user_id logs out user [OK]

Hint: Any method removing session[:user_id] logs out user [OK]

Common Mistakes:

• Only using session[:user_id] = nil and ignoring others
• Trying to clear session without removing user_id
• Confusing session.clear with resetting entire app

3. Given this Rails controller code snippet:

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to dashboard_path
  else
    render :new
  end
end

What happens when the user enters correct email and password?

medium

A. User ID is saved in session and redirected to dashboard

B. User is redirected to login page again

C. Session is cleared and user stays on login page

D. An error is raised because session[:user_id] is not set

Solution

1. Step 1: Analyze authentication condition

   The code checks if a user with the given email exists and if the password matches using authenticate.

2. Step 2: Understand session assignment and redirect

   If authentication passes, it stores the user's ID in session and redirects to the dashboard.

3. Final Answer:

   User ID is saved in session and redirected to dashboard -> Option A

4. Quick Check:

   Correct login sets session[:user_id] and redirects [OK]

Hint: Correct login sets session[:user_id] and redirects [OK]

Common Mistakes:

• Assuming user stays on login page after success
• Thinking session[:user_id] is not set on success
• Confusing render with redirect behavior

4. Identify the error in this logout action:

def logout
  session[:user] = nil
  redirect_to root_path
end

medium

A. No error, this code works fine

B. redirect_to should be redirect_back

C. session[:user] = nil does not clear session

D. Session key should be :user_id, not :user

Solution

1. Step 1: Check session key used for authentication

   Rails session-based authentication typically uses session[:user_id] to track logged-in user.

2. Step 2: Identify mismatch in session key

   The code sets session[:user] to nil, which does not clear the actual user ID stored in session[:user_id].

3. Final Answer:

   Session key should be :user_id, not :user -> Option D

4. Quick Check:

   Correct session key is :user_id [OK]

Hint: Use session[:user_id] to clear login, not session[:user] [OK]

Common Mistakes:

• Using wrong session key name
• Assuming setting any session key to nil logs out user
• Confusing redirect_to with redirect_back

5. You want to restrict access to a controller action so only logged-in users can see it. Which code snippet correctly checks session-based authentication before allowing access?

hard

A. before_action :require_login

def require_login
redirect_to login_path unless session[:user_id]
end

B. before_action :require_login

def require_login
redirect_to login_path if session[:user_id]
end

C. before_action :require_login

def require_login
redirect_to root_path unless session[:user_id]
end

D. before_action :require_login

def require_login
redirect_to login_path unless session[:user]
end

Solution

1. Step 1: Understand access control with before_action

   Use a method to check if session[:user_id] exists before allowing access.

2. Step 2: Identify correct redirect condition

   If session[:user_id] is missing, redirect to login page to block access.

3. Final Answer:

   Redirect to login unless session[:user_id] exists -> Option A

4. Quick Check:

   Access allowed only if session[:user_id] present [OK]

Hint: Redirect unless session[:user_id] exists to protect pages [OK]

Common Mistakes:

• Redirecting if session[:user_id] exists (wrong logic)
• Using wrong session key like :user
• Redirecting to wrong path on failure