# User\_engine question: session expiry

**URL:** <https://www.ruby-forum.com/t/user-engine-question-session-expiry/99441>\
**Category:** Engines\
**Created:** [January 31, 2006, 5:18pm UTC](https://www.ruby-forum.com/t/user-engine-question-session-expiry/99441 "2006-01-31T17:18:46Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![waddilove](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/b5ac83/32.png) [@waddilove](https://www.ruby-forum.com/u/waddilove)\
**Post date:** [January 31, 2006, 5:18pm UTC](https://www.ruby-forum.com/t/user-engine-question-session-expiry/99441/1 "2006-01-31T17:18:46Z")

</div>

First, James thanks again for giving us these engines. This makes it so  
easy to control access to Rails sites in a flexible manner. Just what  
the Dr. ordered.

I need to extensions to the basic user\_engine and I am wondering if I  
have missed finding similar features in the documentation. Or failing  
that, some suggestion on how best to add this functions.

I’d like to be able to expire a user’s session. So for example I’d like  
to time-stamp each request from a user session and then if more than xxx  
minutes have passed I would like the user to have to log back in.  
Similarly, I would like to force the user to re-verfiy their user id and  
password for a subset of actions.

Many thanks - Jonathan

---

<div class="post-metadata">

**Author:** ![waddilove](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/b5ac83/32.png) [@waddilove](https://www.ruby-forum.com/u/waddilove)\
**Post date:** [February 3, 2006, 12:50pm UTC](https://www.ruby-forum.com/t/user-engine-question-session-expiry/99441/2 "2006-02-03T12:50:11Z")

</div>

Probably the simplest way to do this is just using an additional  
before\_filter, something like:

class ApplicationController \< ActionController::Base  
include LoginEngine; include UserEngine

before\_filter :authorize\_action  
before\_filter :expire\_stale\_session

def expire\_stale\_session  
if user?  
if session[:user\_timestamp].nil?  
session[:user\_timestamp] = Time.now  
return true  
elsif (Time.now - session[:user\_timestamp]) \> 600 #seconds  
session[:user] = nil # log them out  
session[:user\_timestamp] = nil # reset the timer  
flash[:message] = “Your session has timed out. Please  
re-authenticate…”  
store\_location # so when they do log in they come back here  
access\_denied # redirect them to the login page  
return false # stop the filtering  
end  
end  
end  
end

… I’ve not tested that at all, but something along those lines  
should work. To require the user to re-enter their password, you could  
a line of code like below to the top of only those certain actions  
(presuming that you’ve supplied a form on those pages which puts the  
password into params[:password])

if User.authenticate(current\_user.login, params[:password]).nil?  
flash[:message] = “Wrong password!”  
return  
end

Essentially you’re just checking if the current user can be  
authenticated with the password they’ve just supplied. Again - I’ve  
not tested that but it should be something like this.

On 1/31/06, Jonathan W. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> minutes have passed I would like the user to have to log back in.  
> [http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org](http://lists.rails-engines.org/listinfo.cgi/engine-users-rails-engines.org)

–

- J \*  
~

---

<div class="post-metadata">

**Author:** ![waddilove](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/b5ac83/32.png) [@waddilove](https://www.ruby-forum.com/u/waddilove)\
**Post date:** [February 4, 2006, 6:38pm UTC](https://www.ruby-forum.com/t/user-engine-question-session-expiry/99441/3 "2006-02-04T18:38:09Z")

</div>

James,

Many thanks for the suggestions, I’ll give them a try!

- Jonathan