# Handling a failed login - doesn't seem to work

**URL:** <https://www.ruby-forum.com/t/handling-a-failed-login-doesnt-seem-to-work/89204>\
**Category:** Rails\
**Created:** [March 18, 2007, 5:09pm UTC](https://www.ruby-forum.com/t/handling-a-failed-login-doesnt-seem-to-work/89204 "2007-03-18T17:09:44Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![macfizz](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/b9bd4f/32.png) [@macfizz](https://www.ruby-forum.com/u/macfizz)\
**Post date:** [March 18, 2007, 5:09pm UTC](https://www.ruby-forum.com/t/handling-a-failed-login-doesnt-seem-to-work/89204/1 "2007-03-18T17:09:44Z")

</div>

Hi all,

I’m having a problem with a piece of code that should be handling a  
failed login attempt.

I have created a before filter in a controller called  
StoryController, that should only be applied for the new method:

#code  
before\_filter :login\_required, :only =\> new  
#code

login\_required is defined in my ApplicationController:

#code  
def login\_required  
# if logged\_in is true, then just exit  
return true if logged\_in?  
# otherwise, store the user’s request url so we can come back later  
session[:return\_to] = request.request\_uri  
# redirect the user back to the login page and return false  
redirect\_to :controller =\> “/account”, :action =\> “login” and  
return false  
end  
#code

and logged\_in is also defined, as a helper method, in my  
ApplicationController:

#code  
def logged\_in?  
! @current\_user.blank?  
end  
helper\_method :logged\_in?  
#code

Finally, @current\_user is set in the ApplicationController too, with  
the help of another before filter called fetch\_logged\_in\_user:

#code  
before\_filter :fetch\_logged\_in\_user  
protected  
def fetch\_logged\_in\_user  
# if there is no current user, just exit the method and return  
return if session[:user\_id].blank?  
# otherwise fetch a User object with an id that is equal to the  
id stored in the session container  
# and assign it to the @current \_user instance variable  
@current\_user = User.find\_by\_id(session[:user\_id])  
end  
#code

Anyway, this all seems to make a certain amount of sense to me.  
@current\_user is being set for every page load: a further check for  
the current logged-in user is made when someone attempts to create a  
new story, and if there is no logged-in user then the application  
redirects to a login page. If I read things correctly, since the  
filter returns false then the current controller method (new) should  
just exit, so no story should get created. Sadly, that is not what  
happens in practice. Instead, the story submission works regardless  
of whether or not there is a logged-in user. The only difference is  
that if a user has logged in then their user\_id is stored in the  
story table, and otherwise a NULL is stored in the relevant column.

It appears to me that the login\_required filter is not being applied,  
but I cannot understand why it is not. Can anyone help enlighten me?  
BTW I am not a hugely experienced Rails programmer and this code is  
from a book (Build your own RoR Web Applications by Patrick Lenz):  
I’ve checked my code against the book and the code archive.

Any help much appreciated.