# How is this even possible?!

**URL:** <https://www.ruby-forum.com/t/how-is-this-even-possible/75356>\
**Category:** Rails\
**Created:** [November 9, 2006, 10:59am UTC](https://www.ruby-forum.com/t/how-is-this-even-possible/75356 "2006-11-09T10:59:08Z")\
**Posts on this page:** 6\
**Page:** 1

<div class="post-metadata">

**Author:** ![timperrett](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c5a1d2/32.png) [@timperrett](https://www.ruby-forum.com/u/timperrett)\
**Post date:** [November 9, 2006, 10:59am UTC](https://www.ruby-forum.com/t/how-is-this-even-possible/75356/1 "2006-11-09T10:59:08Z")

</div>

Hey all

I have the scenario where by i have an anonymous checkout on a shop, but  
somtimes i tihnk if there are concurrent users (lets say users A and  
B), user A gets there results they would expect on the review page, but  
user B gets user A’s details?!?!

How can this even be happening as in the controller code im using the  
session[:order\_id] to identify shopping baskets and the like. I have  
just moved to AR sessions from PStore, is there some issue with AR  
sessions comparitivly to PStore?

Is the @your\_order var somhow becomming populated with somone elses  
details before the view is rendered? i really cant see how this is  
happening. Any help would be a godsend!!!

The code in my controller…

def review  
begin  
@your\_order = Order.find(session[:order\_id])  
@contents = @your\_order.items  
rescue  
flash[:notice] = ‘Unfortunatly all the data required to enable you  
to checkout was unobtainable.’  
redirect\_to(’/store/basket’)  
end  
if @your\_order  
@subtotal = @your\_order.item\_total(session[:currency].to\_i)  
@billing\_address =  
CustomerAddress.find(@your\_order.order\_billing\_address)  
if @your\_order.seperate\_shipping\_address == true  
@delivery\_address =  
CustomerAddress.find(@your\_order.order\_shipping\_address)  
else  
@delivery\_address = @billing\_address  
end  
end  
end

---

<div class="post-metadata">

**Author:** ![timperrett](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c5a1d2/32.png) [@timperrett](https://www.ruby-forum.com/u/timperrett)\
**Post date:** [November 9, 2006, 12:08pm UTC](https://www.ruby-forum.com/t/how-is-this-even-possible/75356/2 "2006-11-09T12:08:16Z")

</div>

Tim P. wrote:

> I have the scenario where by i have an anonymous checkout on a shop, but  
> somtimes i tihnk if there are concurrent users (lets say users A and  
> B), user A gets there results they would expect on the review page, but  
> user B gets user A’s details?!?!
> 
> How can this even be happening as in the controller code im using the  
> session[:order\_id] to identify shopping baskets and the like. I have  
> just moved to AR sessions from PStore, is there some issue with AR  
> sessions comparitivly to PStore?

Can you post the code that creates the Basket object in the first place  
and assigns its ID to the session variable? Maybe there’s something in  
there.

Chris

---

<div class="post-metadata">

**Author:** ![timperrett](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c5a1d2/32.png) [@timperrett](https://www.ruby-forum.com/u/timperrett)\
**Post date:** [November 9, 2006, 9:12pm UTC](https://www.ruby-forum.com/t/how-is-this-even-possible/75356/3 "2006-11-09T21:12:18Z")

</div>

Hi!

On Nov 9, 2006, at 1:59 AM, Tim P. wrote:

> Hey all
> 
> I have the scenario where by i have an anonymous checkout on a  
> shop, but  
> somtimes i tihnk if there are concurrent users (lets say users A and  
> B), user A gets there results they would expect on the review page,  
> but  
> user B gets user A’s details?!?!

```
How are you testing this fact? Are you just opening two browser

```

windows on your own computer and logging into two accounts? If so  
then that is your problem right there. The twop sessions would step  
on each other. If this isn’t the case then ignore what i said.

Cheers-  
– Ezra Z.  
– Lead Rails Evangelist  
– removed\_email\_address@domain.invalid  
– Engine Y., Serious Rails Hosting  
– (866) 518-YARD (9273)

---

<div class="post-metadata">

**Author:** ![timperrett](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c5a1d2/32.png) [@timperrett](https://www.ruby-forum.com/u/timperrett)\
**Post date:** [November 10, 2006, 10:41am UTC](https://www.ruby-forum.com/t/how-is-this-even-possible/75356/4 "2006-11-10T10:41:19Z")

</div>

if your session is defined globally then you may get this problem

---

<div class="post-metadata">

**Author:** ![timperrett](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c5a1d2/32.png) [@timperrett](https://www.ruby-forum.com/u/timperrett)\
**Post date:** [November 10, 2006, 10:34am UTC](https://www.ruby-forum.com/t/how-is-this-even-possible/75356/5 "2006-11-10T10:34:21Z")

</div>

Hey guys

Thanks for your replys. Its not that, its like it might get populated  
with someone elses data tottaly, that was nothing to do with me!

Ive tracked the problem and i think its somthing to do with the session  
not carrying the order\_id in the session correctly. or for some reason  
its bombing out.

I’ll keep diggin to see what i can find

Cheers

Tim

---

<div class="post-metadata">

**Author:** ![timperrett](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/t/c5a1d2/32.png) [@timperrett](https://www.ruby-forum.com/u/timperrett)\
**Post date:** [November 10, 2006, 10:45am UTC](https://www.ruby-forum.com/t/how-is-this-even-possible/75356/6 "2006-11-10T10:45:02Z")

</div>

Bala Murugan wrote:

> if your session is defined globally then you may get this problem

When you say globally what particularly do you mean?

Cheers

Tim