# Why does UserSession.find return nil when using user\_credentials = single\_access\_token?

**URL:** <https://www.ruby-forum.com/t/why-does-usersession-find-return-nil-when-using-user-credentials-single-access-token/182347>\
**Category:** Rails\
**Created:** [January 26, 2010, 8:13pm UTC](https://www.ruby-forum.com/t/why-does-usersession-find-return-nil-when-using-user-credentials-single-access-token/182347 "2010-01-26T20:13:30Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![coolaj86](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/74df32/32.png) [@coolaj86](https://www.ruby-forum.com/u/coolaj86)\
**Post date:** [January 26, 2010, 8:13pm UTC](https://www.ruby-forum.com/t/why-does-usersession-find-return-nil-when-using-user-credentials-single-access-token/182347/1 "2010-01-26T20:13:30Z")

</div>

I believe that I’ve set up everything such that single\_access\_token  
should be sufficient to pull a user’s session.

The scenario is:  
Bob uses Firefox and creates an account on LoginUI (http://  
www.coolaj86.info/loginui).  
Instead of using cookies, Bob’s single\_access\_token comes in the  
response to the request.  
LoginUI submits Bob’s single\_access\_token with every request  
(essentially using it as though it were the persistence token).  
Bob clicks ‘account settings’ and changes his password, but the  
request fails.

The request fails because the record is not found (presumably it’s  
trying to find Bob by the persistence token rather than the single  
access token.

I’ve been very thorough in looking through the documentation, but I  
must be missing something. What is it that I’m neglecting?

class UsersController \< ApplicationController  
def update  
# params[:user\_credentials].inspect shows the correct  
‘xxxSingle\_Access\_Tokenxxx’  
user\_hash = RegisteredUserSession.find.record  
user = RegisteredUser.find(user\_hash)  
user.update(params[:user])  
user.save

```
respond_to do |format|
  format.json { head :ok }
end

```

end

private  
def single\_access\_allowed?  
true  
end  
end

class UserSession \< Authlogic::Session::Base  
allow\_http\_basic\_auth = true  
params\_key = ‘user\_credentials’  
single\_access\_allowed\_request\_types = :all  
end

class RegisteredUserSession \< UserSession  
end

class User \< ActiveRecord::Base  
set\_table\_name “users”  
attr\_accessible :display\_name, :email, :password

acts\_as\_authentic do |c|  
c.require\_password\_confirmation = false  
end

class \<\< self  
def public\_hash(obj)  
{  
:display\_name =\> obj.display\_name,  
:email =\> obj.email,  
:single\_access\_token =\> obj.single\_access\_token,  
:errors =\> obj.errors  
}  
end  
end  
end

class RegisteredUser \< User  
attr\_accessible :display\_name, :email, :password

validates\_presence\_of :display\_name  
validates\_length\_of :password, :within=\>6…254

acts\_as\_authentic do |c|  
c.require\_password\_confirmation = false  
c.change\_single\_access\_token\_with\_password = true  
c.email\_field = ‘email’  
end  
end

---

<div class="post-metadata">

**Author:** ![coolaj86](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/74df32/32.png) [@coolaj86](https://www.ruby-forum.com/u/coolaj86)\
**Post date:** [January 26, 2010, 8:15pm UTC](https://www.ruby-forum.com/t/why-does-usersession-find-return-nil-when-using-user-credentials-single-access-token/182347/2 "2010-01-26T20:15:16Z")

</div>

apologies, I meant to send this to the authlogic list