what was i smoking ? Some url resources are under a login ie. can only access them if a user is logged in. approaches: 1. maintain a previous url app-wide and redirect back after sign_in. for signout maintain a list of protected actions so we do not redirect back there have to make sure circular redirects do not happen 2. before redirecting to l…

README.md

what was i smoking ?

Some url resources are under a login ie. can only access them if a user is logged in.

approaches:

1. maintain a previous url app-wide and redirect back after sign_in. for signout maintain a list of protected actions so we do not redirect back there have to make sure circular redirects do not happen

2. before redirecting to login, store the back url and thereafter do not maintain "back" url.

(2) is much simpler. rails has "redirect :back" but it does not work for all cases

also for (1) have to code special cases. eg. /checkout -> /sign_in -> /forgot_password -> /sign_in now after sign_in the previous url is /forgot_password but should not redirect there

another case is am logged in and am at /checkout not after /signout should not get redirected to any url which requires a login because it will again take me to a /signin page

so in all respects the (2) is simpler and more error-proof. is a little more explicit though

also redirects do not work on POST requests only on GET requests can create a special GET alias url for the POST resource or call the POSTed resource programmatically and redirect to the show resource

approach_1.rb

class ApplicationController < ActionController::Base  
  after_filter :store_referrer
  
  #https://github.com/plataformatec/devise/wiki/How-To:-Redirect-back-to-current-page-after-sign-in,-sign-out,-sign-up,-update
  def after_sign_in_path_for(resource)
    if session[:redirect_back_to]
      logger.info { "after sign_in redirect to redirect_back_to: #{session[:redirect_back_to].inspect}" } 
      session[:redirect_back_to]
    else
      logger.info { "after sign_in redirect to root_path: #{session[:root_path].inspect}" } 
      root_path
    end
  end

  def after_update_path_for(resource)
    after_sign_in_path_for(resource)
  end

  def after_sign_out_path_for(resource)
    # TODO: what other url's are protected by sign_in. do not want to
    # redirect there. check check_authentication method
    back = session[:previous_url]
    back = "" if back =~ /^\/checkout/
    back.blank? ? root_path : back
  end

  protected
  # https://github.com/plataformatec/devise/wiki/How-To:-Redirect-back-to-current-page-after-sign-in,-sign-out,-sign-up,-update
  def store_referrer
    # /user/sign_in and /users/password/new etc under users are exempt
    # as otherwise we will have circular redirects
    # rg. before checkout the user goes to /user/sign_in and then
    # refreshes the page a couple of times. so now session[:previous_url] is /user/sign_in
    # and after login the user is redirected back to the login page

    # likewise json and xhr (ajax) requests are an internal
    # detail. we cannot redirect the user back to a json page

    # TODO: do not call on admin pages
    
    if !request.format.json? &&
        !request.xhr? &&
        request.fullpath =~ /\/users/
      if request.get?
        session[:previous_url] = request.fullpath
      else
        # for POST requests a special GET request alias is needed as
        # redirects only support GET
        # or call the POST action programmatically here
        # this works because the POST request has simple params.
        # it will not work if the POST request has for eg. a file upload
        if request.fullpath =~ /\/checkout/
          # /checkout is post
          session[:previous_url] = request.fullpath
        end
      end
    end    
  end

  def check_authentication
    if current_user.blank?
      redirect_to user_session_url
      return
    end
  end
end

class CheckoutController < ApplicationController  
  before_filter :check_authentication
end

approach_2.rb

class ApplicationController < ActionController::Base    
  #https://github.com/plataformatec/devise/wiki/How-To:-Redirect-back-to-current-page-after-sign-in,-sign-out,-sign-up,-update
  def after_sign_in_path_for(resource)
    if session[:redirect_back_to]
      logger.info { "after sign_in redirect to redirect_back_to: #{session[:redirect_back_to].inspect}" } 
      session[:redirect_back_to]
    else
      logger.info { "after sign_in redirect to root_path: #{session[:root_path].inspect}" } 
      root_path
    end
  end

  def after_update_path_for(resource)
    after_sign_in_path_for(resource)
  end

  def after_sign_out_path_for(resource)
    root_path
  end

  def check_authentication
    if current_user.blank?
      session[:redirect_back_to] = request.fullpath
      redirect_to user_session_url
      return
    end
  end
end

class CheckoutController < ApplicationController  
  before_filter :check_authentication
end