# Access to session data

**URL:** <https://www.ruby-forum.com/t/access-to-session-data/55833>\
**Category:** Rails\
**Created:** [March 24, 2006, 4:38am UTC](https://www.ruby-forum.com/t/access-to-session-data/55833 "2006-03-24T04:38:58Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![rick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/9f8e36/32.png) [@rick](https://www.ruby-forum.com/u/rick)\
**Post date:** [March 24, 2006, 4:38am UTC](https://www.ruby-forum.com/t/access-to-session-data/55833/1 "2006-03-24T04:38:58Z")

</div>

Greetings,

This, I hope, is a simply answered question.

Based on Agile Web D. with Rails (depot application), I’m  
developing a single table application for contact info. There is only  
an admin side to this, so there’s always authentication.

Part of the info record (member) is changed\_by and changed\_at which I  
automatically want updated. Changed\_at looks after itself (yay!);  
however changed\_by doesn’t. Since I know who is accessing the table  
(everyone has a user\_name) I’ve stored user\_name in the session. I  
can retrieve and display this information to the input form that is  
collecting the info, so I know that there is session[:user\_name].

Getting it into the active record is more difficult. What I have done  
is inside the class for member.rb I’ve added a callback method:

def before\_save  
self.changed\_by = “Rick”  
end

and this will work. However,

def before\_save  
self.changed\_by = session[:user\_name]  
end

does not, complaining that session is undefined :-(.

Obviously session is not available everywhere. How do I reference the  
session correctly from inside the member class?

All flames and grace welcome.

Regards,

Rick W.

---

<div class="post-metadata">

**Author:** ![rick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/9f8e36/32.png) [@rick](https://www.ruby-forum.com/u/rick)\
**Post date:** [March 24, 2006, 4:53am UTC](https://www.ruby-forum.com/t/access-to-session-data/55833/2 "2006-03-24T04:53:45Z")

</div>

On 3/23/06, Rick W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> automatically want updated. Changed\_at looks after itself (yay!);  
> end  
> session correctly from inside the member class?

The first step to recovery is giving up on accessing the session from  
the model.  
That way madness lies: [The Apologetic Coder - The Daily WTF](http://thedailywtf.com/forums/65091/ShowPost.aspx)

However, you do have a number of good options. Here are a couple:

class Something \< ActiveRecord::Base  
attr\_writer :user  
def before\_save  
return false unless @user && @user.can\_update(self)  
self[:changed\_by] = @user  
end  
end  
That assumes that your User model has a method “can\_update()” that  
checks the user’s permissions.

Then, in your controller, assuming @something is the instance of  
Something that you’re manipulating:  
@something.user = session[:user]  
@something.save

Another alternative would look similar, but basically be a wrapper  
around save that took a user as a parameter:

def save\_by\_user(user)  
raise SecurityError unless user.can\_update(self) rescue nil  
self[:changed\_by] = user  
self.save  
end

---

<div class="post-metadata">

**Author:** ![rick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/r/9f8e36/32.png) [@rick](https://www.ruby-forum.com/u/rick)\
**Post date:** [March 24, 2006, 6:26am UTC](https://www.ruby-forum.com/t/access-to-session-data/55833/3 "2006-03-24T06:26:31Z")

</div>

I solved the same problem with some very useful wiki entries and blogs I  
found…

[http://livsey.org/2005/07/16/adding\_created\_by\_and\_updated\_by\_to\_rails](http://livsey.org/2005/07/16/adding_created_by_and_updated_by_to_rails)  
[http://wiki.rubyonrails.com/rails/pages/Howto+Add+created\_by+and+updated\_by](http://wiki.rubyonrails.com/rails/pages/Howto+Add+created_by+and+updated_by)

and the accessing session[] from a model is discussed here…

[http://www.koziarski.net/archives/2005/07/16/environment](http://www.koziarski.net/archives/2005/07/16/environment)