# Deleting Sessions with no logout **URL:** \ **Category:** Rails\ **Created:** [May 11, 2009, 9:45pm UTC](https://www.ruby-forum.com/t/deleting-sessions-with-no-logout/167714 "2009-05-11T21:45:06Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [May 11, 2009, 9:45pm UTC](https://www.ruby-forum.com/t/deleting-sessions-with-no-logout/167714/1 "2009-05-11T21:45:06Z")
HI all, I have an app that has a admin side and a user side. The users logging into the admin side can view and edit profile, if need be, on the user side. However, the user has three types: admin, travel manager, and traveler. An admin logs in, the admin session is set. If the admin looks at a user “Traveler” profile the traveler session gets set. What I have noticed is that the admin instead of logging it, like they should be, simply click the ‘X’. Under certain conditions, I have started to notice that this is causing some unwanted behavor and have come to the conclusion that I need to make sure that the session variables for both a traveler and a travel manager get set to nil when the admin logs out of that profile or 'X’s out. My question is, how the heck do you do this? I could use javaScript but then how would I call the controller method? I have read that there is a onClose event in javaScript but it’s not supportted in all browsers. Is there a Rails way to do this? Thanks, -S ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [May 11, 2009, 11:50pm UTC](https://www.ruby-forum.com/t/deleting-sessions-with-no-logout/167714/2 "2009-05-11T23:50:16Z")
I tried this: In View: \<% func = remote\_function( :url =\> { :action =\> ‘set\_sessions\_nil’} ) -%\> "\> ..... In Controller: def set\_sessions\_nil session[:user] = nil session[:arranger] = nill end Pretty straight forward, but after I open and close a few windows my server running the localhost dies - it just sits there and does nothing, so don’t try that a home. -S ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [May 12, 2009, 9:40am UTC](https://www.ruby-forum.com/t/deleting-sessions-with-no-logout/167714/3 "2009-05-12T09:40:41Z")
I think you may find there is no reliable way of achieving this, there was a significant thread on this issue a little while ago. What is the unwanted behaviour that you are seeing? Perhaps there is a better solution. Colin 2009/5/11 Shandy N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [May 12, 2009, 11:13pm UTC](https://www.ruby-forum.com/t/deleting-sessions-with-no-logout/167714/4 "2009-05-12T23:13:49Z")
Colin L. wrote: > I think you may find there is no reliable way of achieving this, there > was a > significant thread on this issue a little while ago. > What is the unwanted behaviour that you are seeing? Perhaps there is a > better solution. > Colin > > 2009/5/11 Shandy N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) It has to do with the sessions which are holding id for the current users logged in. At most, there may be three session variables set - the two above and another called session[:admin]. An admin can move from profile to profile making modifications, but what I think is happening is that the admin are not “logging” like they should and are instead simply "X"ing out. This means that those sessions may be used to set up unwanted objects and show links, and other varous forms of undesired information. ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [May 13, 2009, 4:55pm UTC](https://www.ruby-forum.com/t/deleting-sessions-with-no-logout/167714/5 "2009-05-13T16:55:42Z")
Colin L. wrote: > 2009/5/12 Shandy N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > > > It has to do with the sessions which are holding id for the current > > users logged in. At most, there may be three session variables set - the > > two above and another called session[:admin]. An admin can move from > > profile to profile making modifications, but what I think is happening > > is that the admin are not “logging” like they should and are instead > > simply "X"ing out. This means that those sessions may be used to set up > > unwanted objects and show links, and other varous forms of undesired > > information. > > Do you mean another user is coming along to the pc that had the admin > user > logged in and using it as admin? Or that someone is picking up the admin > role on another PC when they should not? Or something else? No, an admin logs in and they can view and edit other profiles (not other admin profiles), all from the same PC. ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [May 13, 2009, 11:14am UTC](https://www.ruby-forum.com/t/deleting-sessions-with-no-logout/167714/6 "2009-05-13T11:14:32Z")
2009/5/12 Shandy N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) > It has to do with the sessions which are holding id for the current > users logged in. At most, there may be three session variables set - the > two above and another called session[:admin]. An admin can move from > profile to profile making modifications, but what I think is happening > is that the admin are not “logging” like they should and are instead > simply "X"ing out. This means that those sessions may be used to set up > unwanted objects and show links, and other varous forms of undesired > information. Do you mean another user is coming along to the pc that had the admin user logged in and using it as admin? Or that someone is picking up the admin role on another PC when they should not? Or something else? ---
**Author:** ![snantz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/c2a13f/32.png) [@snantz](https://www.ruby-forum.com/u/snantz)\ **Post date:** [May 13, 2009, 4:58pm UTC](https://www.ruby-forum.com/t/deleting-sessions-with-no-logout/167714/7 "2009-05-13T16:58:40Z")
I still do not understand the problem you are seeing. Colin 2009/5/13 Shandy N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)