Ruby on Rails session storage - how to *not* store certain fields in session store?

Question

• WARNING: Complete newbie to RoR and Ruby alert! *

I have a login method that looks like this:

@user = Person.find(:first, :conditions => ["email=?", params[:email]])
if @user and @user.password==params[:user_password]
   session[:user] = @user
else
   flash[:warn] = 'Invalid password!'

However, the user record can get very large, so I don't want to store the entire user record in my cookie session.

How can I modify this code so that a specific field does not get stored in the session? There are two fields that can get very large (very large user profile data) and will not fit within the cookie session 4 kilobyte limit, so I want to exclude those from being stored in the session.

Answer 1

I would do :

session[:user] = @user.id

And then create a before_filter going something like this:

before_filter :get_user

def get_user
  @user = User.find_by_id(session[:user])
end

edit: This is not exactly what you were looking for, but if you can't store all the object in the session variable you might want to consider this option. It's only one request so it won't be too resource intensive. Plus like this you can check at every page load that the user exists and this might be helpful, security wise.

Answer 2

The design of Rails often serves to steer you in a very specific direction. In this case, the fact that by default Rails' sessions are stored in a cookie is a strong hint that you shouldn't be storing large objects in the session. By all means store the User ID, but not the User object itself.