cookie persistence with omniauth and linkedin gem

Question

I'm running a rails application that lets users successfully authenticate with LinkedIn and import their LinkedIn profile data. The (big) problem I'm having is that the cookie data associated with one user that signs in first persists even after they sign out, and is pulled in for another separate user after they authenticate through LinkedIn. The first user's data overwrites the second user's data...big problem.

Help is very much appreciated!

Here is my sessions_controller:

class SessionsController < ApplicationController

    def new
    end

    def create
        if env['omniauth.auth']
            user = User.from_omniauth(env['omniauth.auth'])
            session[:user_id] = user.id
        redirect_to auth_path
        flash[:success] = 'Signed in with LinkedIn.'
        else
            user = User.find_by_email(params[:session][:email])
            if user && user.authenticate(params[:session][:password])
                sign_in user
                redirect_back_or user
                flash[:success] = 'Signed in the old-fashioned way.'
            else
                flash.now[:error] = 'Invalid email/password combination'
                render 'new'
            end         
        end
    end

    def destroy
        cookies.delete(:remember_token)
        session[:user_id] = nil
        redirect_to root_path
    end
end

Answer 1

I was having the exact same issue. Somewhere in your omniauth configurations there should be a path configuration for where the user is redirected to.

Before https://api.linkedin.com/uas/oauth/authenticate

After - This fixed everything for me and made the controller action always require an authorization when executed so that new users on the same computer would not automatically use last user's LinkedIn cookie. https://www.linkedin.com/uas/oauth/authorize