lib/authenticated_system.rb
# When called with before_filter :login_from_cookie will check for an :auth_token
# cookie and log the user back in if apropriate
When called with before_filter :login_from_cookie will check for an :auth_token
cookie and log the user back in if apropriate
When called with before_filter : login_from_cookie will check for an : auth_token cookie and log the user back in if apropriate
def login_from_cookie
      return unless cookies[:token] && !logged_in?
      self.current_user = site.user_by_token(cookies[:token])
      ActiveRecord::Base.with_writable_records do
        cookies[:token] = {
          :value => self.current_user.reset_token!,
          :expires => self.current_user.token_expires_at
        } if logged_in?
      end
      true
    end
def login_from_cookie return unless cookies [ :token ] && ! logged_in? self . current_user = site . user_by_token ( cookies [ :token ] ) ActiveRecord :: Base . with_writable_records do cookies [ :token ] = { :value => self . current_user . reset_token! , :expires => self . current_user . token_expires_at } if logged_in? end true end
When called with before_filter :login_from_cookie will check for an :auth_token
cookie and log the user back in if apropriate
When called with before_filter : login_from_cookie will check for an : auth_token cookie and log the user back in if apropriate
# TODO - We allow the token to be changed on GET requests and we log # the user in.  I haven't fully analyzed the consequences of allowing # session and token updates on hostile GET requests triggered by CSRF # attacks.  If this helps out in some kind of attack, it would affect # almost every single web application in existence.