# Validation using session data

**URL:** <https://www.ruby-forum.com/t/validation-using-session-data/76221>\
**Category:** Rails\
**Created:** [November 16, 2006, 9:07pm UTC](https://www.ruby-forum.com/t/validation-using-session-data/76221 "2006-11-16T21:07:29Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![cwu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/dfb087/32.png) [@cwu](https://www.ruby-forum.com/u/cwu)\
**Post date:** [November 16, 2006, 9:07pm UTC](https://www.ruby-forum.com/t/validation-using-session-data/76221/1 "2006-11-16T21:07:29Z")

</div>

I have a model containing user records and I want each user to only be  
able to edit his own data. I am storing the user\_id in a session table.  
I was hoping to be able to use validate\_on\_update that would compare  
the POSTed id with that stored in the session table, so I wrote (in the  
model/user.rb file):

def validate\_on\_update  
if session[:user\_id] != id  
errors.add(“You are not allowed to edit this record.”)  
end  
end  
end

When I do an update I get “undefined local variable or method `session’  
for #”

What concept am I not getting here?

Thanks

---

<div class="post-metadata">

**Author:** ![cwu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/dfb087/32.png) [@cwu](https://www.ruby-forum.com/u/cwu)\
**Post date:** [November 16, 2006, 9:45pm UTC](https://www.ruby-forum.com/t/validation-using-session-data/76221/2 "2006-11-16T21:45:26Z")

</div>

CWu wrote:

> I have a model containing user records and I want each user to only be  
> able to edit his own data. I am storing the user\_id in a session table.  
> I was hoping to be able to use validate\_on\_update that would compare  
> the POSTed id with that stored in the session table, so I wrote (in the  
> model/user.rb file):
> 
> def validate\_on\_update  
> if session[:user\_id] != id  
> errors.add(“You are not allowed to edit this record.”)  
> end  
> end  
> end
> 
> When I do an update I get “undefined local variable or method `session’  
> for #”
> 
> What concept am I not getting here?
> 
> Thanks

session is part of the ActionController you need to pass the data to the  
model.  
the simplest way around this would be to simply never allow a foreign  
user access to the form that edits by redirecting (not hiding the link).

---

<div class="post-metadata">

**Author:** ![cwu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/dfb087/32.png) [@cwu](https://www.ruby-forum.com/u/cwu)\
**Post date:** [November 16, 2006, 10:05pm UTC](https://www.ruby-forum.com/t/validation-using-session-data/76221/3 "2006-11-16T22:05:48Z")

</div>

So how do I pass the data to the model?

---

<div class="post-metadata">

**Author:** ![cwu](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/dfb087/32.png) [@cwu](https://www.ruby-forum.com/u/cwu)\
**Post date:** [November 16, 2006, 11:32pm UTC](https://www.ruby-forum.com/t/validation-using-session-data/76221/4 "2006-11-16T23:32:10Z")

</div>

On 11/17/06, CWu [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> So how do I pass the data to the model?

That is a bad idea. For your case it is better to perform that checking  
inside controller action.

Model should be independent of all that “session” thing. Model exists  
outside of those sessions. What would you pass to the model, if model  
update  
is run from Rails’ console ?

This is similar to authorization checking. You would never pass user to,  
say, Post model to see if user is allowed to see it, right ?