[Rails] Re: invalidating a session on multiple login

Martin DeMello
Fri, 23 Jun 2006 10:08:47 -0000

I don''t see why it''s weird GUI-wise - it''s a standard
application with
all pages gated by a single user login. There aren''t any roles or
anything involved; it''s just that the data displayed on the page
depends on who the logged in user is. Logging in authenticates the
user against the db, returns a User, and fills it into session[:user].
Per-controller authentication simply checks that session[:user] is not
nil - that may be the design flaw, but if it is, I can''t see what else
I could do with a pure back-end operation.

To give a concrete example, let''s say that user Foo has surfed over to
http://myhost/user/preferences and is editing his preferences page.
Now he opens another browser tab and logs in as user Bar. I obligingly
 reset the session, logging Foo out. Now let''s say he goes back to the
first tab and hits save. It''ll post a preferences form to
/user/saveprefs, but now session[:user] is Bar, and Bar''s preferences
will get updated with the form data Foo was filling in. Short of
passing in a user id as a parameter to every controller action, or (as
I mentioned in the last post) having a periodic ajax call to check
that the user who opened the current page matches the session user, I
don''t see what to do design-wise to defend against this.

martin

On 6/23/06, Peter Ertl <peter.ertl@gmx.net> wrote:
> I would reconsider the gui design of your application as this kind of
> login / logout - scenario is weird...
>
> if you have different roles in your applications you should use a user
> <=> roles mapping
> and extend the session credentials.
>
> Martin DeMello schrieb:
> > Okay, this is even harder than I thought. Consider the following use
> > case: user1 logs in. He opens a new tab and tries to log in again.
> > Either by making him click logout or transparently, I reset the
> > session, and log him in as user2. The previous tab will still be
> > changed to user2, since the session reset can''t affect the
client side
> > - I''m beginning to think the only thing to do is store the
logged in
> > user in javascript and do a timed ajax call to see if it matches the
> > session user and invalidate the page on the client side if not. Anyone
> > have a better idea?
> >
> > martin
> > _______________________________________________
> > Rails mailing list
> > Rails@lists.rubyonrails.org
> > http://lists.rubyonrails.org/mailman/listinfo/rails
>
> _______________________________________________
> Rails mailing list
> Rails@lists.rubyonrails.org
> http://lists.rubyonrails.org/mailman/listinfo/rails
>