phatworx/devise_security_extension — pull request #104 by RicardoBrazao (2014-12-16 14:23:40+00:00)
Title: Clear session after session limitable unauthorises the request

Why this pull request?

If you have a user model that have many locations, and the id of the location that he chooses is stored in the session hash we can have the case where the session has id's relative to other users.

Simple use case

Following the previous example, we have a user that logs itself in the browser window A and after that he logs again but in a incognito window, when he refreshes the page in window A he will be redirected to the 'users/signin' page because of the session_limitable attribute but his session won't be cleared so if he then logs again in window A with a different account the session will contain fields from the previous session.