0

How to get an user or it's UserID by session ID (from cookie) when using Devise Authentication gem? I need to access this info from a background thread where session variable isn't accessible.

Long explanation:

I have two ports open on web server: one is for normal HTTP communication, other is for Web Sockets, for instant server-to-browser communication. Currently I initialize socket with

var UserID = <%= current_user.id %>

but consider this way to be insecure. Every authenticated user can replace user ID and receive messages intended for other user.

So I think that SessionID stored in cookie is much harder to guess and it could be extracted by JavaScript in some way and passed through Web Socket during initialization.

The task is to convert SessionID to UserID on server side.

Is sessionID storage accessible as a whole through some Devise methods?

Paul
  • 25,812
  • 38
  • 124
  • 247

1 Answers1

1

A devise session is stored as warden user key. You can find the user ID by devise session key. Try User.find(session["warden.user.user.key"][1][0]) Refer to this link for more details.

Community
  • 1
  • 1
noman tayyab
  • 355
  • 3
  • 14