Rails 3 + Devise：超时后注销用户

Question

In my app I set Devise to timeout a session after 30 minutes. Which works fine... the user has to log in again after that time. My only problem is that devise apparently doesn't use the destroy action in the session controller after a session has timed out. So the attribute :signed_in for the user isn't set to 'false'. So even after a session has timed out this user is still displayed as online. Is there a way to destroy the session after the timeout or set the signed_in attribute to false after a certain time and on browser close?

My destroy action in session controller:

def destroy
  current_user.try("signed_in=", false); current_user.save
  signed_in = signed_in?(resource_name)
  sign_out_and_redirect(resource_name)
  set_flash_message :notice, :signed_out if signed_in
end

Answer 1

I'm not exactly an expert on Devise but I suspect this is because of the stateless nature of HTTP. Devise only knows a session is timed out when the user tries to access a page again after your timeout length and will likely only call the destroy method when a user actually logs out and the destroy method is called on the session controller.

In order to achieve what you are likely looking for, you would need to run a background process that sweeps for old sessions and then manually calls the destroy method (or does something similar).

Answer 2

With the new Devise version it works as follows to have an accurate online/offline status:

put this in your application_controller:

before_filter :last_request

def last_request
 if user_signed_in?
  if current_user.last_request_at < 1.minutes.ago
    current_user.update_attribute(:last_request_at, Time.now)
  end
  if current_user.currently_signed_in = false
      current_user.update_attribute(:currently_signed_in, true)
  end
 end
end

With every action the app checks if the last request was over 1min ago, if yes, he updates the user attribute.

put this in user.rb:

before_save :set_last_request

Warden::Manager.after_authentication do |user,auth,opts|
  user.update_attribute(:currently_signed_in, true)
end

Warden::Manager.before_logout do |user,auth,opts|
  user.update_attribute(:currently_signed_in, false)
end

def set_last_request
  self.last_request_at = Time.now
end

def signed_in?
 if self.currently_signed_in

  if self.timedout?(self.last_request_at.localtime)
    return false
  else
    return true
  end

 else
  false
 end
end

you can then use the signed_in? method to determine a users online status.