mmangino/mogli — Issue #90: Switching Users Doesn't Destroy the Session
Author: travisjtodd
Created: 2011-11-17 08:03:48+00:00
State: open

I posted this on Stack Overflow, but haven't got a good answer yet. I'm hoping maybe it would get answered here quicker.

http://stackoverflow.com/questions/8076359/switching-users-in-facebook-app-using-one-click-sinatra-ruby-and-heroku-host

0 down vote favorite
share [fb] share [tw]

I'm writing my first Sinatra app using Facebook's new one-click cloud hosting via Heroku. I'm formally a Ruby on Rails developer but this is my first experience with the Mogli gem.

My question is that the sample app provided by Heroku/Facebook is a great start but seems to store the user data in the session as session[:at]. When I switch users in the same browser and go back to the app, I see the previously logged-in user's data. This is a pretty big security flaw.

**Is there a simple way using the Mogli gem to check if the logged in user matches the session and if not redirect to the auth page?**

Here's the code in case you're not familiar with how the sample app handles facebook authentication:

```ruby
get "/" do
redirect "/auth/facebook" unless session[:at]
@client = Mogli::Client.new(session[:at])

# limit queries to 15 results
@client.default_params[:limit] = 10

@app = Mogli::Application.find(ENV["FACEBOOK_APP_ID"], @client)
@user = Mogli::User.find("me", @client)

erb :index
end

get "/auth/facebook" do
session[:at]=nil
redirect authenticator.authorize_url(:scope => FACEBOOK_SCOPE, :display => 'page')
end

get '/auth/facebook/callback' do
client = Mogli::Client.create_from_code_and_authenticator(params[:code], authenticator)
session[:at] = client.access_token
redirect '/'
end
```

Thanks in advance!