Session-based authentication in Ruby on Rails - Step-by-Step Execution

Concept Flow - Session-based authentication

User submits login form

↓

Server checks credentials

↓

Create session

↓

Store session ID in cookie

↓

User requests protected page

↓

Server reads session ID from cookie

↓

Allow access

This flow shows how a user logs in, the server creates a session stored in a cookie, and later requests check that session to allow or deny access.

Execution Sample

Ruby on Rails

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to '/dashboard'
  else
    redirect_to '/login'
  end
end

This code logs in a user by checking credentials and storing the user ID in the session if valid.

Execution Table

Step	Action	Input	Session State	Output/Redirect
1	User submits login form	email=[e-mail], password=secret	{}	Check credentials
2	Server finds user by email	[e-mail]	{}	User found
3	Server authenticates password	secret	{}	Password valid
4	Server sets session user_id	user.id=42	{user_id: 42}	Redirect to /dashboard
5	User requests /dashboard	cookie with session user_id=42	{user_id: 42}	Allow access
6	User requests /profile without session	no session cookie	{}	Redirect to /login

💡 Execution stops when user is redirected or access is granted/denied based on session presence.

Variable Tracker

Variable	Start	After Step 4	After Step 5	After Step 6
session	{}	{user_id: 42}	{user_id: 42}	{}
user	nil	User(id=42)	User(id=42)	nil
params	{}	{email: '[e-mail]', password: 'secret'}	{}	{}

Key Moments - 3 Insights

Why does the server store user_id in session instead of user object?

The server stores only user_id in session (see Step 4) because sessions hold small data like IDs, not full objects, to keep session size small and secure.

What happens if the session cookie is missing on a protected page request?

As shown in Step 6, if the session cookie is missing, the server redirects the user to the login page because it cannot verify the user identity.

Why do we check credentials before setting the session?

Step 3 ensures the password is correct before setting session[:user_id] in Step 4, preventing unauthorized access.

Visual Quiz - 3 Questions

Look at the execution table, what is the session state after Step 4?

A {"email": "[e-mail]"}

B {"user_id": 42}

C {}

D {"password": "secret"}

💡 Hint

Check the 'Session State' column at Step 4 in the execution table.

At which step does the server redirect the user to the login page due to missing session?

A Step 2

B Step 4

C Step 6

D Step 5

💡 Hint

Look at the 'Output/Redirect' column for the step where session is empty and redirect happens.

If the password was incorrect, what would happen at Step 3?

A Redirect to /login

B Session user_id is set

C Redirect to /dashboard

D User is found

💡 Hint

Refer to the 'Action' and 'Output/Redirect' columns around Step 3 in the execution table.

Concept Snapshot

Session-based authentication in Rails:
- User submits login form with email and password.
- Server verifies credentials.
- If valid, server stores user_id in session hash.
- Session ID is saved in browser cookie.
- On protected pages, server checks session user_id.
- If session missing or invalid, redirect to login.

Full Transcript

Session-based authentication in Rails works by having the user submit a login form with their email and password. The server then looks up the user by email and checks if the password matches. If the credentials are correct, the server stores the user's ID in the session hash. This session is linked to the user via a cookie stored in the browser. When the user requests protected pages, the server reads the session cookie to find the user ID and allows access if valid. If the session is missing or invalid, the server redirects the user back to the login page. This process keeps the user logged in securely across requests.

Practice

1. What does session[:user_id] typically store in a Rails application using session-based authentication?

easy

A. The user's password

B. The user's email address

C. The ID of the currently logged-in user

D. The entire user object

Solution

1. Step 1: Understand session usage in Rails

   Rails uses the session hash to store small pieces of data between requests, commonly the user ID for authentication.

2. Step 2: Identify what session[:user_id] holds

   This key stores the unique identifier of the logged-in user to recognize them on subsequent requests.

3. Final Answer:

   The ID of the currently logged-in user -> Option C

4. Quick Check:

   session[:user_id] = user ID [OK]

Hint: Remember session stores user ID, not full user data [OK]

Common Mistakes:

• Thinking session stores full user object
• Confusing user ID with password or email
• Assuming session is client-side storage

2. Which of the following is the correct way to log out a user by clearing the session in a Rails controller?

easy

A. session.clear

B. All of the above

C. session[:user_id] = nil

D. session.delete(:user_id)

Solution

1. Step 1: Review methods to clear session data

   In Rails, you can remove session data by clearing all keys, deleting a specific key, or setting a key to nil.

2. Step 2: Confirm all options effectively log out user

   All three methods remove the user ID from session, effectively logging out the user.

3. Final Answer:

   All of the above -> Option B

4. Quick Check:

   Any method removing user_id logs out user [OK]

Hint: Any method removing session[:user_id] logs out user [OK]

Common Mistakes:

• Only using session[:user_id] = nil and ignoring others
• Trying to clear session without removing user_id
• Confusing session.clear with resetting entire app

3. Given this Rails controller code snippet:

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    session[:user_id] = user.id
    redirect_to dashboard_path
  else
    render :new
  end
end

What happens when the user enters correct email and password?

medium

A. User ID is saved in session and redirected to dashboard

B. User is redirected to login page again

C. Session is cleared and user stays on login page

D. An error is raised because session[:user_id] is not set

Solution

1. Step 1: Analyze authentication condition

   The code checks if a user with the given email exists and if the password matches using authenticate.

2. Step 2: Understand session assignment and redirect

   If authentication passes, it stores the user's ID in session and redirects to the dashboard.

3. Final Answer:

   User ID is saved in session and redirected to dashboard -> Option A

4. Quick Check:

   Correct login sets session[:user_id] and redirects [OK]

Hint: Correct login sets session[:user_id] and redirects [OK]

Common Mistakes:

• Assuming user stays on login page after success
• Thinking session[:user_id] is not set on success
• Confusing render with redirect behavior

4. Identify the error in this logout action:

def logout
  session[:user] = nil
  redirect_to root_path
end

medium

A. No error, this code works fine

B. redirect_to should be redirect_back

C. session[:user] = nil does not clear session

D. Session key should be :user_id, not :user

Solution

1. Step 1: Check session key used for authentication

   Rails session-based authentication typically uses session[:user_id] to track logged-in user.

2. Step 2: Identify mismatch in session key

   The code sets session[:user] to nil, which does not clear the actual user ID stored in session[:user_id].

3. Final Answer:

   Session key should be :user_id, not :user -> Option D

4. Quick Check:

   Correct session key is :user_id [OK]

Hint: Use session[:user_id] to clear login, not session[:user] [OK]

Common Mistakes:

• Using wrong session key name
• Assuming setting any session key to nil logs out user
• Confusing redirect_to with redirect_back

5. You want to restrict access to a controller action so only logged-in users can see it. Which code snippet correctly checks session-based authentication before allowing access?

hard

A. before_action :require_login

def require_login
redirect_to login_path unless session[:user_id]
end

B. before_action :require_login

def require_login
redirect_to login_path if session[:user_id]
end

C. before_action :require_login

def require_login
redirect_to root_path unless session[:user_id]
end

D. before_action :require_login

def require_login
redirect_to login_path unless session[:user]
end

Solution

1. Step 1: Understand access control with before_action

   Use a method to check if session[:user_id] exists before allowing access.

2. Step 2: Identify correct redirect condition

   If session[:user_id] is missing, redirect to login page to block access.

3. Final Answer:

   Redirect to login unless session[:user_id] exists -> Option A

4. Quick Check:

   Access allowed only if session[:user_id] present [OK]

Hint: Redirect unless session[:user_id] exists to protect pages [OK]

Common Mistakes:

• Redirecting if session[:user_id] exists (wrong logic)
• Using wrong session key like :user
• Redirecting to wrong path on failure