Rails 8 - timing out a session

rubyonrails-talk
1

Hi,

very very casual rails user here (mostly via Ruby, which I use for general programming). Some time ago I developed a simple rails app to visualize some data and store it in a database. For authentication, I used the built-in authentication generator (I believe…it’s been a while).

While that works great, the user never gets logged out as one might expect after idling for a while. I believe this has to do with sessions. From what I can gather, the session controller comes with a method self.sweep, which is meant to wipe stale sessions and force a user to re-authenticate.

What I don’t get is how that is supposed to run - since that sweep method is never called, and as far as I can tell there isn’t any place where I could place that call to be run every x minutes or integrate it somehow into each user request.

Is this supposed to go into a file I am missing, or a cron job (if so, I am not clear on how that would work).

Anything I am missing here? Thanks in advance for any hints.

Cheers, Marc

2

Typically this would be handled by logging the user’s time of log in somewhere (e.g. on the User model or some other database record), and then expanding the session authentication to ensure that too much time has not passed.

3

Just to close this - I followed the new Tutorial for Rails 8, and I simply mis-understood the bit about session sweeping. I believe the tutorial makes some changes to the session controller, and then introduces the sweep function - but that has to go into the model, not the controller. After moving it into the right place (and calling it on every authentication check via the authentication “concerns”, the website now logs people out of the session hasn’t been refreshed in 1 hour.