Rails - Jun 2005 - Intercepting form posts for login or otherwise

Is this possible? 

Say you have a form, but want to require login before data can be saved.
So, using the login generator, you use the redirect and authorize methods.

link to form > redirect to login > login > redirect to form

However, this only works with GET requests, or, only works with
intercepting links.


What I''m proposing is a post interceptor; additionally, the form can
be submitted, *before* checking for the user to be logged in.

submit form > redirect to login > login > re-post form 

----

To make things more complicated, the whole deal works with ajax (it
renders the login in-page)

<%= form_remote_tag ... %>
<textarea name=''stuff''> ... </textarea>
<input type=''submit'' />
</form>

then, when they hit submit, it checks to see if the user is logged in
(and the form is secure) and returns a login form with render_action
like so: (this replaces the ajaxed form with a login form, and hidden
parameters)

<%= form_remote_tag ... %>
username : <input type=''text''
name=''login'' ..>
password : <input type=''password'' ..>
</form>

My question is, how would you handle the intercepted @params?
This is all kinda pseudo code..

1. hidden fields
 <% @params.each |key,value| %>
  <input type=''hidden'' name=''<%= key
%>'' value=''<%= value %>'' />

2. hidden textareas
  <textarea style=''display:none''><%= value
%></textarea>

3. script-fu
  <script type=''text/javascript''>
  form.add_element(''<%= CGI.escape ... %>'');
 </script>

4. store the params hash in the session

The problem with most of these methods is escaping or serializing the
posted values into HTML.
>From here:
http://xkr.us/articles/javascript/encode-compare/
  - escape() will not encode: @*/+
  - encodeURI() will not encode: !@#$&*()=:/;?+''
  - encodeURIComponent() will not encode: !*()''


The other issue is, who wants to keep potentially that much
information in the session?

Any ideas?

:)

courtenay
http://habtm.com

On 6/22/05, Courtenay <court3nay-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
wrote:
... 
> What I''m proposing is a post interceptor; additionally, the form
can
> be submitted, *before* checking for the user to be logged in.
> 
> submit form > redirect to login > login > re-post form
...
> The other issue is, who wants to keep potentially that much
> information in the session?
I believe that this information doesn''t need to be stored for long in
a session.  Here is how I envision it being implemented:

1a. client: submit form
1b. rails app: serializes request; stores the serialized request in a
session; redirect client to login
2a. client: requests login page (through redirection)
2b. rails app: retrieves and erases the serialized request from
session; returns the login page with a hidden field containing the
serialized request
3a. client: submits login form
3b. rails app: if successful login then recreate request from hidden
field and process the request and return results page

This seems feasible to me.  My questions are, how can a request get
serialized and how can it get recreated and then resubmitted to the
dispatcher after the login succeeds?

- Dennis