# Sessions or lookups?

**URL:** <https://www.ruby-forum.com/t/sessions-or-lookups/55109>\
**Category:** Rails\
**Created:** [March 17, 2006, 12:46am UTC](https://www.ruby-forum.com/t/sessions-or-lookups/55109 "2006-03-17T00:46:47Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![david](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/aeb1de/32.png) [@david](https://www.ruby-forum.com/u/david)\
**Post date:** [March 17, 2006, 12:46am UTC](https://www.ruby-forum.com/t/sessions-or-lookups/55109/1 "2006-03-17T00:46:47Z")

</div>

My application needs to know if a user is an administrator, for security  
and aesthetic reasons. At the moment, I store true/false in the session  
by doing the following at login:

session[:user\_is\_admin] = authenticated\_user.is\_admin?

Is this OK to do? Or should I really be doing the following every time:

User.find(session[:user\_id]).is\_admin?

(user\_id is always in the session too)

Is there a nicer way to do this, or should I be using one of the above?

Cheers.

---

<div class="post-metadata">

**Author:** ![david](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/aeb1de/32.png) [@david](https://www.ruby-forum.com/u/david)\
**Post date:** [March 17, 2006, 12:57am UTC](https://www.ruby-forum.com/t/sessions-or-lookups/55109/2 "2006-03-17T00:57:59Z")

</div>

The Agile Development With Rails document uses something similar.  
But it checks to see if session[:user] == nil.

I was paranoid when implementing something similar using PHP. I just  
queried the database in every page that was loaded… didn’t trust the  
\_SESSION[]

---

<div class="post-metadata">

**Author:** ![david](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/aeb1de/32.png) [@david](https://www.ruby-forum.com/u/david)\
**Post date:** [March 17, 2006, 1:37am UTC](https://www.ruby-forum.com/t/sessions-or-lookups/55109/3 "2006-03-17T01:37:20Z")

</div>

David-

```
What I like to do for this is to just store the user id in the

```

session so the session stays small. Then I have a method called  
current\_user that you can use in your controllers or views to get the  
full current user object. It goes like this:

def current\_user  
@current\_user ||= session[:user] ? User.find\_by\_id(session  
[:user]) : nil  
end

helper\_method :current\_user

You can put that in application.rb and it will be available to all  
controllers and views. Then you just refer to current\_user.is\_admin?  
whenever you need to use it and you will be all set.

Cheers-  
-Ezra

---

<div class="post-metadata">

**Author:** ![david](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/aeb1de/32.png) [@david](https://www.ruby-forum.com/u/david)\
**Post date:** [March 17, 2006, 2:04am UTC](https://www.ruby-forum.com/t/sessions-or-lookups/55109/4 "2006-03-17T02:04:38Z")

</div>

I agree with Vincent, don’t bother with the user\_id. I use session  
[:user] to store the account record of the current user, if it is nil  
then the user is not logged in. If the user is logged in and you want  
to check if they are an admin:  
session[:user].is\_admin?

If your concern is keeping session size down, do it because it  
benefits you.

# I suggest implementing something that is easy to switch back and forth to do performance tests on both.

# def current\_user session[:user] end def current\_user=(user\_record) session[:user] = user\_record end

# can easily be converted to

# def current\_user @current\_user ||= session[:user] ? User.find(session[:user]) : nil end def current\_user=(user\_record) session[:user] = user\_record.id @current\_user = nil end

-John

–  
John S.  
Computing Staff - Webmaster  
Kavli Institute for Theoretical Physics  
University of California, Santa Barbara  
removed\_email\_address@domain.invalid  
(805) 893-6307

---

<div class="post-metadata">

**Author:** ![david](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/aeb1de/32.png) [@david](https://www.ruby-forum.com/u/david)\
**Post date:** [March 17, 2006, 2:22am UTC](https://www.ruby-forum.com/t/sessions-or-lookups/55109/5 "2006-03-17T02:22:48Z")

</div>

On Mar 16, 2006, at 5:02 PM, John S. wrote:

> I agree with Vincent, don’t bother with the user\_id. I use session  
> [:user] to store the account record of the current user, if it is  
> nil then the user is not logged in. If the user is logged in and  
> you want to check if they are an admin:  
> session[:user].is\_admin?

If you do so, take care to not end up with the session object  
deviating from the database row.

i.e. don’t do things like this:

user = User.find(params[:id])  
user.update\_attribute(:blah,user.blah + 1)

because then:

if user.id == session[:user].id and  
user.blah != session[:user].blah  
puts ‘something is wrong’  
end

Will show that you have problem. 🙂

Of course, doing so would represent a bug not unlike any other, but I  
generally try to avoid practices that just begs to cause a problem  
that will be rather hard to track down.

–  
– Tom M.

---

<div class="post-metadata">

**Author:** ![david](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/aeb1de/32.png) [@david](https://www.ruby-forum.com/u/david)\
**Post date:** [March 17, 2006, 2:43pm UTC](https://www.ruby-forum.com/t/sessions-or-lookups/55109/6 "2006-03-17T14:43:42Z")

</div>

Ezra Z. wrote:

> What I like to do for this is to just store the user id in the  
> session so the session stays small. Then I have a method called  
> current\_user that you can use in your controllers or views to get the  
> full current user object. It goes like this:

Thanks Ezra, this seems to be the most effective solution and I have  
gone with it. Thinking about how this method works, I’ve actually  
reduced a lot of “nasty” code in other places too.

I have read too many arguments against storing the whole user object in  
the session, so wanted to try and avoid it.

---

<div class="post-metadata">

**Author:** ![david](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/d/aeb1de/32.png) [@david](https://www.ruby-forum.com/u/david)\
**Post date:** [March 18, 2006, 10:37am UTC](https://www.ruby-forum.com/t/sessions-or-lookups/55109/7 "2006-03-18T10:37:39Z")

</div>

On 17 Mar 2006, at 01:32, Ezra Z. wrote:

> helper\_method :current\_user
> 
> You can put that in application.rb and it will be available to all  
> controllers and views. Then you just refer to  
> current\_user.is\_admin? whenever you need to use it and you will be  
> all set.

I also prefer this method. If you store the complete user object in  
the session and you have access privileges in the user object, the  
user will have to logout and log back in (thus destroying the  
session) in order for his privileges to become active.

Best regards

Peter De Berdt