# Newbie redirect\_to :back related question **URL:** \ **Category:** Rails\ **Created:** [July 2, 2010, 5:14pm UTC](https://www.ruby-forum.com/t/newbie-redirect-to-back-related-question/191010 "2010-07-02T17:14:31Z")\ **Posts on this page:** 7\ **Page:** 1
**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\ **Post date:** [July 2, 2010, 5:14pm UTC](https://www.ruby-forum.com/t/newbie-redirect-to-back-related-question/191010/1 "2010-07-02T17:14:31Z")
Hi, In the course of integrating an authentication module (Authlogic) into my Rails app, I’ve developed the following priority: ‘If the current user makes a url request for which they are ineligible, return the user to the page from which they made their invalid request.’ One way to get at this is with the following two methods in the application\_controller: def store\_location session[:return\_to] = request.request\_uri end def redirect\_back\_or\_default(default) redirect\_to(session[:return\_to] || default) session[:return\_to] = nil end But if I wanted to guarantee that the user was redirected back to any action from which they made an ineligible request, I would need to call store\_location for every such controller action, which is crazy. Is there no inexpensive way that Rails will remember every last request (without resort to session)? My hope would be for something like: redirect\_to :back But this is a no-go… Lille ---
**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\ **Post date:** [July 2, 2010, 5:42pm UTC](https://www.ruby-forum.com/t/newbie-redirect-to-back-related-question/191010/2 "2010-07-02T17:42:09Z")
Lille wrote: > Hi, > > In the course of integrating an authentication module (Authlogic) into > my Rails app, I’ve developed the following priority: > > ‘If the current user makes a url request for which they are > ineligible, return the user to the page from which they made their > invalid request.’ > > One way to get at this is with the following two methods in the > application\_controller: > > def store\_location > session[:return\_to] = request.request\_uri > end > > def redirect\_back\_or\_default(default) > redirect\_to(session[:return\_to] || default) > session[:return\_to] = nil > end > > But if I wanted to guarantee that the user was redirected back to any > action from which they made an ineligible request, I would need to > call store\_location for every such controller action, which is crazy. Not crazy at all. Just put it in a before\_filter. > Is there no inexpensive way that Rails will remember every last > request (without resort to session)? Putting it in the session is pretty inexpensive, and probably the right thing to do. > My hope would be for something like: > > redirect\_to :back > > But this is a no-go… Why? > Lille –Â Marnen Laibow-Koser [http://www.marnen.org](http://www.marnen.org) removed\_email\_address@domain.invalid Sent from my iPhone ---
**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\ **Post date:** [July 2, 2010, 5:54pm UTC](https://www.ruby-forum.com/t/newbie-redirect-to-back-related-question/191010/3 "2010-07-02T17:54:55Z")
On Jul 2, 2010, at 11:42 AM, Marnen Laibow-Koser wrote: > > My hope would be for something like: > > > > redirect\_to :back > > > > But this is a no-go… > > Why? Well, for one thing, you don’t always have an HTTP\_REFERER (if the user types a URL into the browser for example). You get this nearly for free with Authlogic anyway. Just modify the example require\_user and associated code to fit your needs. -Rob Rob B. removed\_email\_address@domain.invalid [http://AgileConsultingLLC.com/](http://AgileConsultingLLC.com/) removed\_email\_address@domain.invalid [http://GaslightSoftware.com/](http://GaslightSoftware.com/) ---
**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\ **Post date:** [July 2, 2010, 6:31pm UTC](https://www.ruby-forum.com/t/newbie-redirect-to-back-related-question/191010/4 "2010-07-02T18:31:49Z")
On Jul 2, 2010, at 12:02 PM, Lille wrote: > @Rob - Yes, I see what you’re referring to in the Authlogic example > code. I guess I can feel comforted by that… > > @Marnen, @Rob - …but isn’t reliance on session expensive, e.g., if > I’ve chosen server-side ActiveRecordStore session storage? Um, compared to what? If the work to instantiate the session from the database, alter a value, and write it base is your bottleneck, I’d say you have one blazingly fast application 😉 I wouldn’t worry about that (at least no yet). You have to load the user info (session + User model) to check the permission anyway so you have to hit the database. -Rob > > Rob B. > > For more options, visit this group at [http://groups.google.com/group/rubyonrails-talk?hl=en](http://groups.google.com/group/rubyonrails-talk?hl=en) > > . Rob B. removed\_email\_address@domain.invalid [http://AgileConsultingLLC.com/](http://AgileConsultingLLC.com/) removed\_email\_address@domain.invalid [http://GaslightSoftware.com/](http://GaslightSoftware.com/) ---
**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\ **Post date:** [July 2, 2010, 6:04pm UTC](https://www.ruby-forum.com/t/newbie-redirect-to-back-related-question/191010/5 "2010-07-02T18:04:17Z")
@Rob - Yes, I see what you’re referring to in the Authlogic example code. I guess I can feel comforted by that… @Marnen, @Rob - …but isn’t reliance on session expensive, e.g., if I’ve chosen server-side ActiveRecordStore session storage? On Jul 2, 11:51 am, Rob B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) ---
**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\ **Post date:** [July 2, 2010, 7:13pm UTC](https://www.ruby-forum.com/t/newbie-redirect-to-back-related-question/191010/6 "2010-07-02T19:13:26Z")
On Jul 2, 2010, at 12:44 PM, Lille wrote: > unauthenticated users can use all app functionality up to a certain > point, when they have to register (a try-before-you-buy approach.) > > So, under this approach I have to apply the require\_user approach in a > before\_filter for every action, not just those associated with a few > protected pages. This just seems like a lot of work. It’s like adding > a layer of authentication goo all over my app and unlike, preferably, > enabling authentication as a ‘switch’ to my app. > > Lille If you only put the before\_filter :require\_user on those controllers (or scoped to :only =\> [:some, :actions]), then you only have the overhead for the actions that really need a user. You can also use (I think) skip\_session to avoid all the session overhead when you have absolutely no need for it. -Rob > > -Rob > > > > > – > > > removed\_email\_address@domain.invalid [http://AgileConsultingLLC.com/](http://AgileConsultingLLC.com/) > > > . Rob B. [http://agileconsultingllc.com](http://agileconsultingllc.com) removed\_email\_address@domain.invalid +1 513-295-4739 Skype: rob.biedenharn ---
**Author:** ![Lille](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/l/f4b2a3/32.png) [@Lille](https://www.ruby-forum.com/u/Lille)\ **Post date:** [July 2, 2010, 6:45pm UTC](https://www.ruby-forum.com/t/newbie-redirect-to-back-related-question/191010/7 "2010-07-02T18:45:17Z")
Rob, I see what you’re saying, esp., given your comment: “you have to load the user info (session + User model) to check the permission anyway so you have to hit the database” Unlike what I sense is anticipated by the Authlogic example code, I take the following approach in my app: unauthenticated users can use all app functionality up to a certain point, when they have to register (a try-before-you-buy approach.) So, under this approach I have to apply the require\_user approach in a before\_filter for every action, not just those associated with a few protected pages. This just seems like a lot of work. It’s like adding a layer of authentication goo all over my app and unlike, preferably, enabling authentication as a ‘switch’ to my app. Lille On Jul 2, 12:20 pm, Rob B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)