Other people's data showing for new user?

[melikecode]

It appears that only one user can be logged in at a time. If more than one user is logged in at the same time, you can end up accessing someone else's details.

Observations:

• On the heroku deployment my friend logged in and he was able to see data that wasn't his. I can also see data that isn't mine. He could also write data to my time management area
• On refreshing the page, it showed me logged in as him. I was able to enter data on his account
• When I logged out and logged back in as me, it showed up as me.

Thoughts:

• Is there something missing in the code to filter? It works locally
• Is it something to do with using user_id as a global variable?
• Is this somethign to do with concurrent login?

What's been tested

• Ainslie logged in and Rob was also logged in . Rob could see her account when he refreshed his page. When he clicked to log out and then clicked to sign out of Twitter, Twitter showed him he was signed into his own account, rather than Ainslie's.

[melikecode]

Check out:

• http://rubylearning.com/blog/2009/09/30/cookie-based-sessions-in-sinatra/
• http://stackoverflow.com/questions/12977341/sinatra-test-with-sessions-and-concurrent-access

[melikecode]

Cookies

[charlottebrf]

Feel like this one is the next critical? I think would be good to use the projects section to order these issues into a priorities order.

[melikecode]

Yep! This one is pretty big, and I think the solution involves cookies, but I'm not sure what type in settings we need to use on the cookies to make it all happen.