Skip to content
This repository has been archived by the owner on Jan 30, 2024. It is now read-only.

Don't set unique_session_id if devise.skip_session_limitable is set #96

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

Don't set unique_session_id if devise.skip_session_limitable is set #96

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e24f417
Don't set unique_session_id if devise.skip_session_limitable is set
aaronchi Oct 8, 2014
069d75b
don't limit impersonated sessions
aaronchi Oct 14, 2014
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions lib/devise_security_extension/hooks/session_limitable.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
# and on authentication. Retrieving the user from session (:fetch) does
# not trigger it.
Warden::Manager.after_set_user :except => :fetch do |record, warden, options|
if record.respond_to?(:update_unique_session_id!) && warden.authenticated?(options[:scope])
if record.respond_to?(:update_unique_session_id!) && warden.authenticated?(options[:scope]) && !warden.request.env['devise.skip_session_limitable'] && !warden.request.session.key?('impersonator_id')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's quite a conditional. Can you refactor into smaller, meaningfully-named methods?

unique_session_id = Devise.friendly_token
warden.session(options[:scope])['unique_session_id'] = unique_session_id
record.update_unique_session_id!(unique_session_id)
Expand All @@ -18,7 +18,7 @@
env = warden.request.env

if record.respond_to?(:unique_session_id) && warden.authenticated?(scope) && options[:store] != false
if record.unique_session_id != warden.session(scope)['unique_session_id'] && !env['devise.skip_session_limitable']
if record.unique_session_id != warden.session(scope)['unique_session_id'] && !env['devise.skip_session_limitable'] && !warden.request.session.key?('impersonator_id')
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is impersonator_id meaningful? This is another good reason to create methods that describe what they do instead of working with hash keys, array elements, etc.

warden.logout(scope)
throw :warden, :scope => scope, :message => :session_limited
end
Expand Down