Session-based authentication in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

What happens after a successful login in a Rails session-based authentication?

In a typical Rails app using session-based authentication, what is stored in the session after a user logs in successfully?

A No data is stored; the session remains empty after login.

B The user's password is stored in the session for quick verification.

C The entire user object is serialized and stored in the session.

D The user's ID is stored in the session hash to identify the logged-in user.

💡 Hint

Think about what minimal information is needed to recognize the user on future requests.

Rails stores the user's ID in the session to identify the user on subsequent requests. Storing passwords or entire user objects is insecure or inefficient.

❓ lifecycle

intermediate

What happens when a user logs out in a Rails session-based authentication?

Which action correctly clears the session to log out a user in Rails?

A session[:user_id] = nil but session data remains intact.

B session.clear to remove all session data.

C session[:user_id] = false to mark user as logged out.

D session.delete(:user_id) to remove the user ID from the session.

💡 Hint

Think about removing all session data to ensure complete logout.

Calling session.clear removes all session data, ensuring the user is fully logged out. Deleting only :user_id or setting it to nil may leave other session data intact.

📝 Syntax

advanced

Identify the correct way to set a session variable in Rails controller

Which of the following code snippets correctly sets the current user's ID in the session?

A session.user_id = current_user.id

B session.set(:user_id, current_user.id)

C session[:user_id] = current_user.id

D session['user_id'] == current_user.id

💡 Hint

Remember how to access and assign values in a Ruby hash.

In Rails, session behaves like a hash. You assign values using square brackets and =. Options B, C, and D are invalid syntax or comparison instead of assignment.

🔧 Debug

advanced

Why does the session not persist after redirect in Rails?

Consider this code snippet in a Rails controller: ```ruby session[:user_id] = @user.id redirect_to dashboard_path ``` But after redirect, session[:user_id] is nil. What is the most likely cause?

Ruby on Rails

session[:user_id] = @user.id
redirect_to dashboard_path

A The session store is not configured properly, so session data is not saved.

B The redirect_to method clears the session automatically.

C The session hash is read-only and cannot be assigned.

D @user.id is nil, so nothing is stored in the session.

💡 Hint

Check if the app has a session store configured in config/initializers or environment files.

If the session store is not set up, Rails cannot save session data between requests, causing session[:user_id] to be nil after redirect.

🧠 Conceptual

expert

Why is storing sensitive data in Rails session discouraged?

Which is the best explanation for why sensitive data like passwords should not be stored in Rails sessions?

A Sessions are stored client-side as cookies, which can be read or tampered with by users.

B Rails sessions expire immediately, so sensitive data is lost too soon.

C Sessions automatically encrypt all data, so storing sensitive data is safe.

D Storing sensitive data in sessions causes the server to crash.

💡 Hint

Think about where session data is stored and who can access it.

Rails sessions by default use cookie store, which stores data on the client side. Even though cookies are signed and encrypted, storing sensitive data like passwords is risky and unnecessary.