Rails 4 Active Record Login Session Failing - ruby

Question

I'm fairly new to Ruby on Rails so apologize if this is a simple problem, but after weeks of searching for a solution, I felt it might just be easier to ask.
I'm working on a Rails 4 site where I want to have active_record based authentication. I modeled the sign up and login process after this example: http://railscasts.com/episodes/250-authentication-from-scratch?view=asciicast
This example works fine if I use cookies for my session storage, but breaks somewhere in the background when I switched it to active_record. When I try to login, it just takes me back to the main page with no flash message and nothing in my current_user (though I have done a test where I render new on the login page instead of redirect and it can find my user info, but as soon as I navigate away, I lose the session)
The cookie session won't work due to file size limitations, but we're open to other options. I've set up the initializers to point to active_records and I've added it to the gemfile, but I can't seem to figure out where it's breaking. Am I missing an insert step somewhere to add it to the db?
Another possible clue is that my protect_from_forgery line gives me a "Can't verify CSRF token authenticity" but the session still fails if I comment out that line.
I apologize if this is a very simple fix, but like I mentioned, I've been searching for a solution for a while now.
Below is the main code running it. If you'd like to see any more of the code, just let me know.
application_controller.rb
class ApplicationController < ActionController::Base
protect_from_forgery with: :null_session
helper_method :current_user
private
def current_user
#current_user ||= User.find(session[:user_id]) if session[:user_id]
end
end
session_controller.rb
class SessionsController < ApplicationController
def new
end
def create
user = User.authenticate(params[:email], params[:password])
if user
session[:user_id] = user.id
redirect_to root_url, :notice => "Logged in! #{User.find(session[:user_id]).email}"
else
flash.now.alert = "Invalid email or password"
render "new"
end
end
def destroy
session[:user_id] = nil
flash[:notice] = "Logged out!"
redirect_to root_url #, :notice => "Logged out!"
end
end
views/sessions/new.html.erb
<h1>Log in</h1>
<%= form_tag sessions_path do %>
<p>
<%= label_tag :email %><br />
<%= text_field_tag :email, params[:email] %>
</p>
<p>
<%= label_tag :password %><br />
<%= password_field_tag :password %>
<%= hidden_field_tag('authenticity_token', form_authenticity_token.to_s)%>
</p>
<p class="button"><%= submit_tag "Log in" %></p>
<% end %>
models/user.rb
class User < ActiveRecord::Base
attr_accessible :email, :password, :password_confirmation
attr_accessor :password
before_save :encrypt_password
validates_confirmation_of :password
validates_presence_of :password, :on => :create
validates_presence_of :email, :on => :create, :message => "Can't be blank"
validates_uniqueness_of :email
def self.authenticate(email, password)
user = find_by_email(email)
if user && user.password_hash == BCrypt::Engine.hash_secret(password, user.password_salt)
user
else
nil
end
end
def encrypt_password
if password.present?
self.password_salt = BCrypt::Engine.generate_salt
self.password_hash = BCrypt::Engine.hash_secret(password, password_salt)
end
end
end

Answer 1

Of course I would stumble upon a fix the next day after I post, but I wanted to share what I found in case others have the same problem. I started recreating the whole project from the example I shared to see if I was missing a step. When I ran that example, it started giving me a null exception, saying it was trying to create a session with no data. I took a look at the active_record github site and found this link in the "issues" section
https://github.com/rails/activerecord-session_store/issues/6
That fixed the null ref I was getting and when I plugged it into my main site it appears to have fixed the problem (or at least it doesn't log me out when I change pages). Not sure how it actually fixed it, but I'll take what I can get.
initializers/session_store.rb
ActiveRecord::SessionStore::Session.attr_accessible :data, :session_id