# Restful Authentication - which users are logged in

**URL:** <https://www.ruby-forum.com/t/restful-authentication-which-users-are-logged-in/131147>\
**Category:** Rails\
**Created:** [March 6, 2008, 1:35pm UTC](https://www.ruby-forum.com/t/restful-authentication-which-users-are-logged-in/131147 "2008-03-06T13:35:49Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [March 6, 2008, 1:35pm UTC](https://www.ruby-forum.com/t/restful-authentication-which-users-are-logged-in/131147/1 "2008-03-06T13:35:49Z")

</div>

Hi,

I’m using Restful Authentication plugin to provide credentials to users  
to my service.

I’d like to be able to list which users are logged into the system. What  
would be the best approach.

At least in the sessions controller I could add a flag for each user  
when they come and go but that means DB action and I’m not sure if  
that’s the proper way.

I found this also:  
[http://matt-beedle.com/2006/12/13/rails-how-to-find-out-who-is-online/](http://matt-beedle.com/2006/12/13/rails-how-to-find-out-who-is-online/)

But I’d like to know your opinion about the best way.

Thanks.

---

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [March 6, 2008, 3:33pm UTC](https://www.ruby-forum.com/t/restful-authentication-which-users-are-logged-in/131147/2 "2008-03-06T15:33:07Z")

</div>

Hi, I also found another tutorial where basically was updating a status  
flag for each user.

[http://blog.levicole.com/articles/category/ror](http://blog.levicole.com/articles/category/ror)

Regards

---

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [March 6, 2008, 9:11pm UTC](https://www.ruby-forum.com/t/restful-authentication-which-users-are-logged-in/131147/3 "2008-03-06T21:11:14Z")

</div>

Hi again,

I’ve been checking more about sessions and all that. I haven’t checked  
every single detail of all possible ways but I think that cokies can be  
used, activeRecordStore, etc.

As said I’m using Restful authentication and that goes with cockies. Ok  
with me so far.

I’ve added a column to my users to store their status. I update it when  
they come and go. But of course users don’t logout when the close their  
browsers. So I would register some actions when users browse the site,  
i.e. record the timestamps.

After doing that I would use a script runner to see if the last activity  
was for example 30 minutes ago, if so then I would update their status  
to logged out.

Do you think that makes sense?

* * *

Btw, is there anything I should clean up from the sessions that Restful  
Auth is creating? Where is the garbage found?

Cheers!

---

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [March 8, 2008, 12:01am UTC](https://www.ruby-forum.com/t/restful-authentication-which-users-are-logged-in/131147/4 "2008-03-08T00:01:53Z")

</div>

Great so that’s another example. Thanks.

In the end I actually decided to use active record store and it is going  
pretty well. But I have some questions about and I’ll start a new topic  
about sessions cleanup and avoiding duplication.

Cheers

---

<div class="post-metadata">

**Author:** ![comopasta](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/59ef9b/32.png) [@comopasta](https://www.ruby-forum.com/u/comopasta)\
**Post date:** [March 7, 2008, 6:16pm UTC](https://www.ruby-forum.com/t/restful-authentication-which-users-are-logged-in/131147/5 "2008-03-07T18:16:17Z")

</div>

> Hi, I also found another tutorial where basically was updating a status  
> flag for each user.

In that direction (storing each user’s last\_visit time in the User  
model) :

[Parked at Loopia](http://pastie.caboo.se/162861)

remark: it only counts the logged-in users.

* * *

How to detect who is online now/was active during the last 5 minutes?

in brief:

- add a last\_visit field to your User model, and
- have controllers update it once per request.\* find who’s online by  
comparing users.last\_visit to 5.minutes.ago

in long :

Example: (where you use some for of  
AuthenticatedSystem to check if the user is logged\_in?)

## migration

class AddLastVisitToUser \< ActiveRecord::Migration  
def self.up  
add\_column :users, :last\_visit, :datetime  
add\_index :users, :last\_visit  
end  
def self.down  
remove\_column :users, :last\_visit  
remove\_index :users, :last\_visit  
end  
end

## model : user.rb

class User \<\< AR  
…  
def record\_last\_visit  
ActiveRecord::Base.connection.execute(“update users set last\_visit =  
now() where id = #{id}”)  
end  
…  
def online?(max\_delay=5.minutes)  
last\_visit && (Time.now - last\_visit \< max\_delay)  
end

## view: who is online now/was active in the last 5 minutes

# Who's online
\<%= User.find(:all, :conditions =\> ["last\_visit \>= ?",5.minutes.ago]).collect{|u| link\_to( u.login\_or\_name, user\_path(:id=\> u))}.join(' - ') %\>
## controllers

class ApplicationController \< ActionController::Base  
include AuthenticatedSystem  
…  
end

## module AuthenticatedSystem protected def logged\_in? … @current\_user.record\_last\_visit unless @last\_visit\_already\_recorded @last\_visit\_already\_recorded = true true end … end

Alain