Login and Sessions

Goal

This snapshot advances Junction Almanac by teaching you to authenticate users with Rails cookie sessions.

Every numbered folder is a complete Rails application. Run this stage independently, then compare it with the previous snapshot to isolate the new responsibility.

Prerequisites

Use Ruby 3.1 or newer, Bundler, PostgreSQL through Docker, and a terminal. Basic Ruby, HTML, and SQL vocabulary will make the framework conventions easier to recognize.

The app listens on port 3000. PostgreSQL is exposed on host port 5434, and every snapshot names a different database so lesson data never leaks between stages.

• Ruby and Bundler
• Docker with Compose
• A code editor and terminal

Concepts

The browser stores an encrypted, signed session cookie. The server stores only a user id in that session and reloads the account for each request—no Devise dependency is involved.

Keep the Rails request path visible: the router selects a controller action, Active Record handles data rules, and an ERB view renders the response inside the shared layout.

Walkthrough

Authenticate with User.authenticate_by, rotate the session on login, expose Current.user, protect private actions, and reset the session on logout.

Read the focused example, then inspect the matching repository snapshot for the surrounding configuration, validation, failure paths, and accessible markup.

if user = User.authenticate_by(email: params[:email], password: params[:password])
  reset_session
  session[:user_id] = user.id
end

Run and verify

Enter 07-Login-And-Sessions, install its bundle, prepare its database when this stage uses one, and start Rails on port 3000.

Open http://localhost:3000. Keep the server log visible so you can connect each browser action to its route, SQL query, rendered view, redirect, or validation error.

git clone https://github.com/michaeldunga1/fcc-rails-blog.git
cd fcc-rails-blog/07-Login-And-Sessions
docker compose -f ../docker-compose.yml up -d
bundle install
bin/rails db:prepare db:seed
bin/rails server -p 3000

Troubleshooting

If login immediately disappears, inspect cookie and secret configuration. Normalize the submitted email exactly as registration does.

If Rails reports a missing table, run bin/rails db:prepare db:seed in the current snapshot. Connection failures usually mean PostgreSQL is stopped or port 5434 is already occupied.

• Read the first exception first
• Confirm the current numbered folder
• Never commit secrets or config/master.key

Try this

Log in as Ada, restart Rails, confirm the session remains valid, then log out.

Test one successful request and one invalid or unauthorized request. A production-minded Rails app must preserve data rules even when someone bypasses the visible links and submits a direct request.

• Make one focused change
• Verify it in the browser
• Move on only after the checkpoint works