songtianlun
f110f26c0b
- Update `destroy` action in `SessionsController` to log out only if the user is currently logged in. - Add a check in the `authenticated?` method of the `User` model to return false if `remember_digest` is nil. - Enhance integration tests to simulate logout in another browser session and verify that the logout link is not present after logging out. These changes improve the robustness of the session management by preventing unnecessary logout attempts and ensuring that authentication checks are more reliable.
25 lines
552 B
Ruby
25 lines
552 B
Ruby
class SessionsController < ApplicationController
|
|
include SessionsHelper
|
|
def new
|
|
end
|
|
|
|
def create
|
|
user = User.find_by(email: params[:session][:email].downcase)
|
|
# if user && user.authenticate(params[:session][:password])
|
|
if user&.authenticate(params[:session][:password])
|
|
reset_session
|
|
remember user
|
|
log_in user
|
|
redirect_to user
|
|
else
|
|
flash.now[:danger] = 'Invalid email/password combination'
|
|
render 'new'
|
|
end
|
|
end
|
|
|
|
def destroy
|
|
log_out if logged_in?
|
|
redirect_to root_url
|
|
end
|
|
end
|