Pat Maddox wrote the following on 01.10.2006 00:29 :
>  On 9/30/06, jack <rails-mailing-list@[...].net> wrote:
>    
> > hehe, nicely done Lionel. I'll have to give this a try. Thanks for the
> > thoughts! Btw, what kind of nasty problems are you referring to?
> >     
> 
>  First off, let me state that I haven't stored a user object in the
>  session in over a year.  So I'm just pointing out two things that I
>  remember :)
> 
>  The first one is a development issue.  Say you're playing with your
>  app in the web browser, and you've logged in.  Then you make a change,
>  any change, to the User model.  The next request that you make will
>  blow up.  As I said, it's been over a year, so I don't know if that's
>  still the case.  I can't see why it would have changed though.
>    

+1: the object itself is serialized and most of the time can't match the
updated class when you try to de-serialize it ->  the whole session is blown.

>  The next one is an issue of stale session data.  If you store the
>  entire user in the session, but update it in the db elsewhere (perhaps
>  the admin modified the user or something), then the session data won't
>  reflect that.  Imagine I'm using your site, and you decide I'm a bad
>  person and disable my account.  If the user data is in the session, my
>  account won't truly be disabled until the next time my info's looked
>  up from the db - e.g. my session expires and I try to log back in.
>    

Most of the time I'm with you on this one: I don't like changes made
somewhere in an application not being reflected in the whole
application. There are cases though where objects in session can make
sense (sometimes you need temporary objects that don't *have* to be
stored outside of a session context, the question of putting them in the
database then must seek an answer on a case-by-case basis depending on
the specific advantages/drawbacks for the case at hand).

Lionel.

--~--~---------~--~----~------------~-------~--~----~
You received this message because you are subscribed to the Google Groups "Ruby on Rails: Ta
lk" group.
To post to this group, send email to rubyonrails-talk@[...].com
To unsubscribe from this group, send email to rubyonrails-talk-unsubscribe@[...].com
For more options, visit this group at http://groups.google.com/group/rubyonrails-talk
-~----------~----~----~----~------~----~------~--~---