# Preserving POST request body across authentication

**URL:** <https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997>\
**Category:** Rails\
**Created:** [April 6, 2008, 11:23am UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997 "2008-04-06T11:23:35Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 6, 2008, 11:23am UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/1 "2008-04-06T11:23:35Z")

</div>

Hello,

I don’t think this is something which has already been answered.

Using, for example Restful authentication, sessions can time-out  
resulting in an authentication screen being shown. The original URI is  
normally saved and redirected to upon a successful authentication with  
something like this:

session[:return\_to] = request.request\_uri

… authentication happens; subsequently …

redirect\_to(session[:return\_to] || default)

However if the original request was a POST the original body is going  
to be lost. Has anyone got a solution which preserves the whole of  
the original request so the authentication process becomes  
transparent?

Thanks  
James.

---

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 6, 2008, 2:49pm UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/2 "2008-04-06T14:49:28Z")

</div>

Why would you want to repost a POST request? If the original URI was  
a data entry form, are you going to repost the same data back to the  
controller? Session time outs are for security. The end user can  
afford to go through a few clicks to get back to what he/she was doing  
in the first place. It is a minor inconvenience for letting your  
session expire.

---

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 7, 2008, 5:51pm UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/3 "2008-04-07T17:51:57Z")

</div>

Thanks for your comments.

“Why would you want to repost a POST request?”  
Because I don’t want the end user to have to do a few more clicks;  
browsers sometimes forget what you told them, or users have “finger  
trouble” when presented with a request to repeat themselves. As far  
as the user is concerned they just sent the only copy of their latest  
novel to us and they’d rather not re-key it.

“Session time outs are for security.”  
Yes, and so I’d like them to be relatively short and this has the  
potential to be inconvenient if we forget their POST data.

Thanks again  
James

---

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 7, 2008, 12:43pm UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/4 "2008-04-07T12:43:18Z")

</div>

Theres a couple of ways you can do this …  
The easiest of course making your session so it doesnt expire 🙂 or  
Depending on how much data you were trying to retain you could set a  
new cookie with the data when editing  
even though the session would expire/be removed the cookie should  
remain. (provided you save to the cookie before trying to log a user  
out)  
then upon re-logging in check the cookie, and ask the user if he/she  
wants to carry on editing. if they select yes load the cookie data  
into the post.  
If your dealing with sat a text area with lots of text then you would  
not be able to store it all in the cookie but could store a pointer  
such as an artice\_id and use memcache to store the text.  
Consider also using a periodic ajax request to save a draft which is  
set to run at lesser intervals to your session timeout, this is what  
sites such as gmail do.  
Or even easier use the ajax call to keep pinging the server when on  
such a critical page and that way it will keep you logged in.

Adam

---

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 7, 2008, 5:52pm UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/5 "2008-04-07T17:52:32Z")

</div>

Yes, I could use a temporary store (memcache or a activerecord would  
both do) for the data and add a reference of some sort to that data  
into my session.

Solutions which do intermediate “pings” of some form don’t seem that  
elegant to me; much better to avoid the need to handle these (and  
their effect on system load) by assuming sessions do time out from  
time to time just before a POST.

However what I am looking for is a neat way to wrap up the re-  
submission of that data out of the temporary store so it’s transparent  
to most of my application. For example the full set of POSTed  
parameters should become available again in the params object when  
I’ve authenticated.

---

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 8, 2008, 1:38am UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/6 "2008-04-08T01:38:24Z")

</div>

On Apr 8, 2008, at 3:51 AM, JamesKay wrote:

> However what I am looking for is a neat way to wrap up the re-  
> submission of that data out of the temporary store so it’s transparent  
> to most of my application. For example the full set of POSTed  
> parameters should become available again in the params object when  
> I’ve authenticated.

could you just pass the full params object to memcache/active record  
before logout.  
That way you dont have to wrap anything.

ie/

require ‘memcache’

#just before system redirects user to logout if session has expired  
user\_id = YOUR\_USER\_ID  
cache = MemCache.new ‘localhost:11211’  
cache.set(user\_id, params)

#when you log back in you can se params programatically as follows  
user\_id = YOUR\_USER\_ID  
params = cache.get(user\_id)

# you might want to filter some of it out by setting params[:whatever]

= nil

---

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 8, 2008, 3:09am UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/7 "2008-04-08T03:09:45Z")

</div>

I have not yet had to do this in Rails, but I did something similar in  
PHP last year. I was using Smarty as the template engine, so I assigned  
all of the parameters to the smarty object then called a smarty template  
that built a form of hidden elements and submitted it. The code looked  
like

```
        $form_action = "parent.php?action=search";
        $form_inputs[] = array("name" => "player_id", "value" => 

```

$player\_id);  
$form\_inputs[] = array(“name” =\> “search\_lname”, “value” =\>  
$lname);  
$form\_inputs[] = array(“name” =\> “search\_fname”, “value” =\>  
$fname);  
$form\_inputs[] = array(“name” =\> “search\_email”, “value” =\>  
$email);

```
        $smarty->assign('form_action', $form_action);
        $smarty->assign('form_inputs', $form_inputs);
        $smarty->display('lib/resubmit_form.tpl');

```

and the template

 {foreach from=$form\_inputs item=form\_input} {/foreach} 

Though it’s not Rails, maybe it will help you get closer to solving your  
problem. I’m sure that I’ll need to port this to Rails at some point,  
but it hasn’t happened yet.

Peace,  
Phillip

---

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 8, 2008, 6:07am UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/8 "2008-04-08T06:07:21Z")

</div>

Or, you could yaml-ize it into a hidden form input field.

Julian.

Learn Ruby on Rails! Check out the FREE VIDS (for a limited time)  
VIDEO #3 out NOW!  
[http://sensei.zenunit.com/](http://sensei.zenunit.com/)

---

<div class="post-metadata">

**Author:** ![JamesKay](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/b3f665/32.png) [@JamesKay](https://www.ruby-forum.com/u/JamesKay)\
**Post date:** [April 8, 2008, 11:42am UTC](https://www.ruby-forum.com/t/preserving-post-request-body-across-authentication/133997/9 "2008-04-08T11:42:44Z")

</div>

Adam, thanks. I think serialising the params object into my store,  
remembering a reference to them, and then params =  
something.get(user\_id) looks like the neatest thing.  
James.