# Multi user CRUD concurrency

**URL:** <https://www.ruby-forum.com/t/multi-user-crud-concurrency/108997>\
**Category:** Rails\
**Created:** [July 10, 2007, 2:22pm UTC](https://www.ruby-forum.com/t/multi-user-crud-concurrency/108997 "2007-07-10T14:22:55Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![bitsmith](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/9de053/32.png) [@bitsmith](https://www.ruby-forum.com/u/bitsmith)\
**Post date:** [July 10, 2007, 2:22pm UTC](https://www.ruby-forum.com/t/multi-user-crud-concurrency/108997/1 "2007-07-10T14:22:55Z")

</div>

is there any tutorial/comments/blog about Rails multi-user concurrency  
and how to prevent other users info from creeping into your session  
if you both are accessing the same record…a rails newbie asks???

---

<div class="post-metadata">

**Author:** ![bitsmith](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/9de053/32.png) [@bitsmith](https://www.ruby-forum.com/u/bitsmith)\
**Post date:** [July 10, 2007, 2:50pm UTC](https://www.ruby-forum.com/t/multi-user-crud-concurrency/108997/2 "2007-07-10T14:50:31Z")

</div>

On 7/10/07, Dave R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> is there any tutorial/comments/blog about Rails multi-user concurrency  
> and how to prevent other users info from creeping into your session  
> if you both are accessing the same record…a rails newbie asks???
> 
> –

If your asking if another user modifies an active\_record that you have  
stored in a users session. Don’t do that.

The general consensus is don’t store them there. Rails sessions make no  
attempt to keep in sync with the database, it just serializes the object  
into the session, it doesn’t hit the db again. The way that a lot of  
people  
look after this is to store just the id into the session, then have a  
lazy  
loading method to get the record.

As an example, the restful\_authentication plugin tracks the current user  
with these two methods

```
# Accesses the current user from the session.
def current_user
  @current_user ||= (session[:user] && 

```

User.find\_by\_id(session[:user]))  
|| :false  
end

```
# Store the given user in the session.
def current_user=(new_user)
  session[:user] = (new_user.nil? || new_user.is_a?(Symbol)) ? nil :

```

new\_user.id  
@current\_user = new\_user  
end

There have been many blogs and threads on this list dealing with this  
issue. A quick google should turn up some answers.

HTH  
Daniel

---

<div class="post-metadata">

**Author:** ![bitsmith](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/9de053/32.png) [@bitsmith](https://www.ruby-forum.com/u/bitsmith)\
**Post date:** [July 10, 2007, 8:05pm UTC](https://www.ruby-forum.com/t/multi-user-crud-concurrency/108997/3 "2007-07-10T20:05:16Z")

</div>

Daniel ----- wrote:

> On 7/10/07, Dave R. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > is there any tutorial/comments/blog about Rails multi-user concurrency  
> > and how to prevent other users info from creeping into your session  
> > if you both are accessing the same record…a rails newbie asks???
> > 
> > –
> 
> If your asking if another user modifies an active\_record that you have  
> stored in a users session. Don’t do that.
> 
> The general consensus is don’t store them there. Rails sessions make no  
> attempt to keep in sync with the database, it just serializes the object  
> into the session, it doesn’t hit the db again. The way that a lot of  
> people  
> look after this is to store just the id into the session, then have a  
> lazy  
> loading method to get the record.
> 
> As an example, the restful\_authentication plugin tracks the current user  
> with these two methods
> 
> ```
> # Accesses the current user from the session.
> def current_user
> @current_user ||= (session[:user] && 
> 
> ```
> 
> User.find\_by\_id(session[:user]))  
> || :false  
> end
> 
> ```
> # Store the given user in the session.
> def current_user=(new_user)
> session[:user] = (new_user.nil? || new_user.is_a?(Symbol)) ? nil :
> 
> ```
> 
> new\_user.id  
> @current\_user = new\_user  
> end
> 
> There have been many blogs and threads on this list dealing with this  
> issue. A quick google should turn up some answers.
> 
> HTH  
> Daniel

…just using Rails simple defaults… and storing things into a  
database how does rails protect the database records ovriting newly  
changed things that another user just changed…i’m going to re-write a  
multi-user business process tracking system and want to know will my  
data be safe from one user who makes changes to ID=100 at the same time  
another user 100 miles away also to ID=100…does rails protect each user  
from the other? i’ll be using Oracle

---

<div class="post-metadata">

**Author:** ![bitsmith](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/9de053/32.png) [@bitsmith](https://www.ruby-forum.com/u/bitsmith)\
**Post date:** [July 10, 2007, 8:33pm UTC](https://www.ruby-forum.com/t/multi-user-crud-concurrency/108997/4 "2007-07-10T20:33:53Z")

</div>

Dave R. wrote:

> ```
> Daniel ----- wrote:
> ```
> 
> > ```
> > On 7/10/07, Dave R.[\<removed\_email\_address@domain.invalid\>](mailto:removed_email_address@domain.invalid)wrote:
> > ```
> > 
> > > ```
> > > is there any tutorial/comments/blog about Rails multi-user concurrency
> > > and how to prevent other users info from creeping into your session
> > > if you both are accessing the same record...a rails newbie asks???
> > > 
> > > –
> > > ```
> > 
> >   
> > 
> > ```
> > If your asking if another user modifies an active_record that you have
> > stored in a users session. Don’t do that.
> > 
> > The general consensus is don’t store them there. Rails sessions make no  
> > attempt to keep in sync with the database, it just serializes the object  
> > into the session, it doesn’t hit the db again. The way that a lot of  
> > people  
> > look after this is to store just the id into the session, then have a  
> > lazy  
> > loading method to get the record.
> > 
> > As an example, the restful\_authentication plugin tracks the current user  
> > with these two methods
> > 
> > ```
> > # Accesses the current user from the session.
> > def current_user
> > @current_user ||= (session[:user] &amp;&amp;
> > 
> > ```
> > 
> > User.find\_by\_id(session[:user]))  
> > || :false  
> > end
> > 
> > ```
> > # Store the given user in the session.
> > def current_user=(new_user)
> > session[:user] = (new_user.nil? || new_user.is_a?(Symbol)) ? nil :
> > 
> > ```
> > 
> > new\_user.id  
> > @current\_user = new\_user  
> > end
> > 
> > There have been many blogs and threads on this list dealing with this  
> > issue. A quick google should turn up some answers.
> > 
> > HTH  
> > Daniel
> > ```
> 
> ```
> ...just using Rails simple defaults.... and storing things into a
> database how does rails protect the database records ovriting newly
> changed things that another user just changed...i'm going to re-write a
> multi-user business process tracking system and want to know will my
> data be safe from one user who makes changes to ID=100 at the same time
> another user 100 miles away also to ID=100..does rails protect each user
> from the other? i'll be using Oracle
> ```

Check out optimistic locking.  
  

```
--
Jack C.[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)
```
  
--~--~---------~--~----~------------~-------~--~----~  
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Talk" group.   
 To post to this group, send email to removed\_email\_address@domain.invalid   
 To unsubscribe from this group, send email to removed\_email\_address@domain.invalid   
 For more options, visit this group at http://groups.google.com/group/rubyonrails-talk?hl=en   
 -~----------~----~----~----~------~----~------~--~---