# Before\_destroy and sessions

**URL:** <https://www.ruby-forum.com/t/before-destroy-and-sessions/76271>\
**Category:** Rails\
**Created:** [November 17, 2006, 3:50am UTC](https://www.ruby-forum.com/t/before-destroy-and-sessions/76271 "2006-11-17T03:50:57Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![justinskolnick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b5a626/32.png) [@justinskolnick](https://www.ruby-forum.com/u/justinskolnick)\
**Post date:** [November 17, 2006, 3:50am UTC](https://www.ruby-forum.com/t/before-destroy-and-sessions/76271/1 "2006-11-17T03:50:57Z")

</div>

(Semi-newbie.) I want to ensure a user’s able to destroy only his own  
objects. I’ve set session info at login:

session[:user\_id] = user.id

Now I try this in the model of my deletable objects:

before\_destroy :destroy\_your\_own

def destroy\_your\_own  
raise “Can’t delete that!” unless session[:user\_id] == self.user.id  
end

which snags EVERY attempted destroy. What am I doing wrong? Better  
ideas?

---

<div class="post-metadata">

**Author:** ![justinskolnick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b5a626/32.png) [@justinskolnick](https://www.ruby-forum.com/u/justinskolnick)\
**Post date:** [November 17, 2006, 4:59am UTC](https://www.ruby-forum.com/t/before-destroy-and-sessions/76271/2 "2006-11-17T04:59:03Z")

</div>

It’s hard to say without seeing the rest of the code, but have you  
tested the value of self.user.id within the method? My guess is that  
self.user.id is nil and thus the error is always raised.

---

<div class="post-metadata">

**Author:** ![justinskolnick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b5a626/32.png) [@justinskolnick](https://www.ruby-forum.com/u/justinskolnick)\
**Post date:** [November 17, 2006, 6:27am UTC](https://www.ruby-forum.com/t/before-destroy-and-sessions/76271/3 "2006-11-17T06:27:10Z")

</div>

Justin S. wrote:

> (Semi-newbie.) I want to ensure a user’s able to destroy only his own  
> objects. I’ve set session info at login:
> 
> session[:user\_id] = user.id

Is the session cookie secure? How easy is it to forge a sessionn with  
someone else’s user.id?

–Dean

---

<div class="post-metadata">

**Author:** ![justinskolnick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b5a626/32.png) [@justinskolnick](https://www.ruby-forum.com/u/justinskolnick)\
**Post date:** [November 18, 2006, 8:36am UTC](https://www.ruby-forum.com/t/before-destroy-and-sessions/76271/4 "2006-11-18T08:36:16Z")

</div>

Models don’t have access to the session, so session[:user\_id] is nil.

Sessions are a controller thing. One way I’ve seen this work is this:

1. Add a ‘current\_user’ class property to your User model
2. Create a before\_filter that sets this to the session[:user] on every  
request (not just at login)
3. In your model code, use ‘User.current\_user’ instead of session[:user]

---

<div class="post-metadata">

**Author:** ![justinskolnick](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b5a626/32.png) [@justinskolnick](https://www.ruby-forum.com/u/justinskolnick)\
**Post date:** [November 18, 2006, 2:38pm UTC](https://www.ruby-forum.com/t/before-destroy-and-sessions/76271/5 "2006-11-18T14:38:37Z")

</div>

I wouldn’t even take the callback/filter route. I’d simply define my  
own method, destroy\_as:

`
class SomeModel < ActiveRecord::Base
  def destroy_as(user)
    return false unless self.user == user
    destroy
  end
end
now the controller - presumably you
have access to the user object, not just
the id - i usually instantiate a user from
an id in the session using a before_filter
def destroy
@obj = SomeModel.find(params[:id]
if @obj.destroy_as(@current_user)
flash[:notice] = ‘It worked!’
else
flash[:error] = ‘It didnt work!’
end
end
Hope that helps. You could alternatively just pass in the user ID to
destroy_as and do the comparison that way but I think this is more
intention revealing.`