# Losing session variable with acts\_as\_authenticated

**URL:** <https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285>\
**Category:** Rails\
**Created:** [October 15, 2007, 5:38pm UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285 "2007-10-15T17:38:39Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 15, 2007, 5:38pm UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/1 "2007-10-15T17:38:39Z")

</div>

Hi,

I initially set up acts\_as\_authenticated to require a user login before  
accessing and updating pages on my recipe site. This worked fine with no  
problems with the user session.

Now, I have changed the setup so that a few pages are available to the  
public, while others that involve create/update/delete actions require a  
user that is logged in. So I created a login form as a partial to  
include on  
every single page. The sign in form displays if not logged in; if the  
user  
is logged in it will display a welcome message to the user.

Now I’m encountering problems where my session[:user] variable gets  
reset to  
nil whenever I do a post request. I still have the session, but I just  
lose  
the variable, and find myself having to explicitly send the user ID as  
hidden input and re-assign the session[:user] variable. Has anyone  
encountered this problem, or have any idea why this would be happening?

## Thanks in advance.

View this message in context:  
[http://www.nabble.com/Losing-session-variable-with-acts\_as\_authenticated-tf4624255.html#a13206124](http://www.nabble.com/Losing-session-variable-with-acts_as_authenticated-tf4624255.html#a13206124)  
Sent from the RubyOnRails Users mailing list archive at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 16, 2007, 12:48am UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/2 "2007-10-16T00:48:37Z")

</div>

I am using exactly this trick on my [http://eq2guild.flame.org/](http://eq2guild.flame.org/) site,  
and have experienced no problems with it.

Can you compare the html code on that opening page with what you have  
in yours? I can send you my controller snipit if it will help.

–Michael

---

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 16, 2007, 7:51pm UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/3 "2007-10-16T19:51:32Z")

</div>

Hi Michael,

Thanks for your reply. Our login forms are pretty much the same except  
that  
your form calls on the /account/login action, whereas mine calls on  
/recipe  
(I had put my login action in my application controller so that it would  
be  
accessible to all my controllers).

This is how I generated it in my view: \<% form\_for :login, login do %\>

It works on my /recipe page, but I just recently noticed that I can’t  
log in  
from my other pages.

Aside from that issue, it would be great if I could take a look at your  
controller code. To me, it doesn’t really seem like any of my  
update/edit  
actions for recipes explicitly change any session variables (except when  
I  
have to re-assign my session[:user] variable to keep the user logged  
in).

Michelle

Michael G.-5 wrote:

> >

–  
View this message in context:  
[http://www.nabble.com/Losing-session-variable-with-acts\_as\_authenticated-tf4624255.html#a13238698](http://www.nabble.com/Losing-session-variable-with-acts_as_authenticated-tf4624255.html#a13238698)  
Sent from the RubyOnRails Users mailing list archive at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 16, 2007, 8:01pm UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/4 "2007-10-16T20:01:28Z")

</div>

Wait, you have your login method in all your controllers? May I ask  
why? 🙂

It seems that having one definite action to log one in is a very good  
thing. That is, /login or /account/login or /log\_me\_in should be the  
only controller/action with a login method. After all, you don’t log  
into a recipe, do you? 🙂

If you require a user to log in before they do certain operations,  
that’s also easily done:

class ToonController \< ApplicationController  
before\_filter :login\_required, :except =\> [ :list,  
:show,  
:show\_avatar,  
:classes,  
:tradeskills ]

Or, in each method:

def new  
if !logged\_in?  
flash[:notice] = ‘You cannot create characters without logging  
in.’  
redirect\_to :action =\> “list”  
else  
@toon = Toon.new  
end  
end

My account controller:

class AccountController \< ApplicationController  
def login  
return unless request.post?  
self.current\_user = User.authenticate(params[:login],  
params[:password])  
if logged\_in?  
redirect\_back\_or\_default(:controller =\> ‘welcome’, :action =\>  
‘index’)  
flash[:notice] = “Logged in successfully”  
end  
end

def logout  
cookies.delete :auth\_token  
reset\_session  
flash[:notice] = “You have been logged out.”  
redirect\_back\_or\_default(:controller =\> ‘welcome’, :action =\>  
‘index’)  
end

As I mentioned, I’m using a modified acts\_as\_authenticated plugin.

–Michael

---

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 16, 2007, 10:38pm UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/5 "2007-10-16T22:38:21Z")

</div>

Sorry, what I mean is that I had put my login method inside my  
application  
controller so it’s accessible to the rest of my controllers. If I leave  
my  
login method in the account controller, my other controllers throw an  
exception with the error “undefined method login”.

My login and logout methods otherwise look similar to yours (they’re  
unmodified from acts\_as\_authenticated).

This is how I’m rendering the login box in the main layout:

\<%= render :partial =\> ‘account/login’, :locals =\> { :current\_user =\>  
@current\_user } %\>

\_login.rhtml (I just changed it so that login is now back in the account  
controller):

\<% if flash[:notice] %\>  
\<%= flash[:notice] %\>  
\<% end %\>

\<% if logged\_in? %\>  
\<%= 'Welcome, ’ + current\_user.first\_name + "! » " %\>  
\<%= link\_to ‘Logout’, :controller =\> ‘account’, :action =\> ‘logout’ %\>  
\<% else %\>  
\<% form\_tag “/account/login” method=“post” %\>

Login  
 \<%= text\_field\_tag 'login', login %\>

Password  
 \<%= password\_field\_tag 'password' %\>

Remember me: \<%= check\_box\_tag 'remember\_me' %\>

\<%= submit\_tag 'Log in' %\>

 \<% end %\> \<% end %\>

Michael G.-5 wrote:

> If you require a user to log in before they do certain operations,
> 
> My account controller:  
> end
> 
> –Michael
> 
> >

–  
View this message in context:  
[http://www.nabble.com/Losing-session-variable-with-acts\_as\_authenticated-tf4624255.html#a13241996](http://www.nabble.com/Losing-session-variable-with-acts_as_authenticated-tf4624255.html#a13241996)  
Sent from the RubyOnRails Users mailing list archive at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 16, 2007, 10:51pm UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/6 "2007-10-16T22:51:47Z")

</div>

On 10/16/07, miss\_michelle [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Sorry, what I mean is that I had put my login method inside my application  
> controller so it’s accessible to the rest of my controllers. If I leave my  
> login method in the account controller, my other controllers throw an  
> exception with the error “undefined method login”.

You should never have “login” run via the path /recipe/login, or  
/book/login, etc. probably – you always want /account/login – so  
login should be in account\_controller.rb only. If you put it in  
app/controllers/application.rb, I believe it can be accessed via  
/recipe/login, etc.

If you need to refer to it inside a different controller, you can  
always redirect to the login page:

redirect\_to :controller =\> :account, :action =\> :login

> This is how I’m rendering the login box in the main layout:

What you did looks basically the same as mine…

Here’s my app/views/account/login.rhtml file:

\<% form\_tag do -%\>

Login  
\<%= text\_field\_tag 'login' %\>

Password  
\<%= password\_field\_tag 'password' %\>

\<%= submit\_tag 'Log in' %\>

\<% end -%\>

This renders to:

Login

Password

---

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 16, 2007, 11:16pm UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/7 "2007-10-16T23:16:23Z")

</div>

I’m wondering why you’re login form is in a login.rhtml rather than a  
partial  
named \_login.rhtml? When I try the \<% form\_tag do -%\> it renders the  
action  
to go to the page that I’m current on, eg. /recipe/list.

Basically, I’m trying to get the layout to be just like yours: login  
form  
included onto each page as a partial. But when I put the login method  
back  
into the application, my recipe controller is complaining about an  
undefined login method. Incidentally, trying to access the path  
/recipe/login results in an error because I have no layout page for  
that.

Michael G.-5 wrote:

> You should never have “login” run via the path /recipe/login, or
> 
> > This is how I’m rendering the login box in the main layout:  
> > \<%= password\_field\_tag ‘password’ %\>
> 
> Password
> 
> >

–  
View this message in context:  
[http://www.nabble.com/Losing-session-variable-with-acts\_as\_authenticated-tf4624255.html#a13242535](http://www.nabble.com/Losing-session-variable-with-acts_as_authenticated-tf4624255.html#a13242535)  
Sent from the RubyOnRails Users mailing list archive at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 17, 2007, 9:41pm UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/8 "2007-10-17T21:41:15Z")

</div>

It turns out that I had been requiring the login method in a  
before\_filter,  
which is why my application was breaking when I moved the login method  
back  
to the account controller. It works now… I’m able to log in from  
different  
pages, and it also fixed my session problem 🙂

Thanks so much for your help!

Michael G.-5 wrote:

> \<% form\_tag(:controller =\> “account”, :action =\> “login”) do %\>
> 
> >

–  
View this message in context:  
[http://www.nabble.com/Losing-session-variable-with-acts\_as\_authenticated-tf4624255.html#a13261345](http://www.nabble.com/Losing-session-variable-with-acts_as_authenticated-tf4624255.html#a13261345)  
Sent from the RubyOnRails Users mailing list archive at [Nabble.com](http://Nabble.com).

---

<div class="post-metadata">

**Author:** ![miss\_michelle](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/c5a1d2/32.png) [@miss\_michelle](https://www.ruby-forum.com/u/miss_michelle)\
**Post date:** [October 17, 2007, 1:52am UTC](https://www.ruby-forum.com/t/losing-session-variable-with-acts-as-authenticated/117285/9 "2007-10-17T01:52:25Z")

</div>

My bad. I have two login forms actually – that one is displayed when  
the user goes to /admin/login specifically.

Here is the one I put in my sidebars, which appears on every page  
unless the user is logged in. And no I don’t have this in a partial  
either, but I probably should…

 \<% form\_tag(:controller =\> "account", :action =\> "login") do %\> Username \<%= text\_field\_tag(:login, params[:login], :size =\> 12, :class =\> "lfield") %\> 

Password \<%= password\_field\_tag(:password, params[:password], :size =\> 12, :class =\> "lfield") %\>

\<%= submit\_tag "Log In", :class =\> "submit\_button" %\> \<% end %\>

This renders into:

 Username 

Password