检测用户是否在不同的域中登录

Question

I'm developing a rails app that creates a widget that you can put on your website. When the widget is displayed (on a website with a different host) to a user who is logged in my app, I would like to display him some additional admin options.

What would be the best and easiest way to figure out if the user is logged in the app?

I was thinking of storing the IP when user logs in, and then compare the IP from the request that is sent to the widget controller.

Answer 1

IP could be deceptive. Try cookies.

Edit: not only in an actively deceptive manner (ie spoofing/Tor) but rather if two people are on separate sites from the same public IP, then you have a false correlation.

Answer 2

I followed the Omniauth Railscast Episode and have been using session variables and a SessionsController to create and destroy sessions when the user logs in and out.

class SessionsController < ApplicationController

  def create
    # create user if new user, or find user account if returning user.
    session[:user_id] = user.id
    redirect_to root_url # or wherever
  end

  def destroy
    session[:user_id] = nil
    redirect_to root_url # or wherever
  end

end

Then in the Application Controller,

 class ApplicationController < ActionController::Base
   def current_user
     @current_user ||= User.find(session[:user_id]) if session[:user_id]
   end
 end

You can then easily determine if a user is logged in or not via if current_user , or equivalently, if session[:user_id] is nil.