RailsApps/rails-composer · error

Access denied.

Error message

Access denied.

What it means

Error "Access denied." thrown in RailsApps/rails-composer.

Source

Thrown at files/app/controllers/application_controller-omniauth.rb:23

  helper_method :correct_user?

  private
    def current_user
      begin
        @current_user ||= User.find(session[:user_id]) if session[:user_id]
      rescue Exception => e
        nil
      end
    end

    def user_signed_in?
      return true if current_user
    end

    def correct_user?
      @user = User.find(params[:id])
      unless current_user == @user
        redirect_to root_url, :alert => "Access denied."
      end
    end

    def authenticate_user!
      if !current_user
        redirect_to root_url, :alert => 'You need to sign in for access to this page.'
      end
    end

end

View on GitHub (pinned to 5a9985f6dd)

Solutions

1. Apply the correct_user? before_filter only to actions that operate on the record owned by the current user.
2. Verify that session[:user_id] is set at login so current_user can match @user.
3. If privileged roles must access other records, extend the check: unless current_user == @user || current_user.admin?

Example fix

def correct_user?
  @user = User.find(params[:id])
  unless current_user == @user
    redirect_to root_url, :alert => "Access denied."
  end
end
before_filter :correct_user?, :only => [:edit, :update]

When it happens

Trigger: Shown as a redirect alert when correct_user? finds that the signed-in user does not match the User record loaded from params[:id], e.g. a user attempts to open another user account page.

Common situations: A signed-in user edits the :id in the URL to another user id; a stale link points to a page owned by a different account; the correct_user? before_filter is applied to an action that should not require record ownership.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of RailsApps/rails-composer@5a9985f6dd (2026-08-23). Data as JSON: /api/errors/8fa43cf17933968a. Report an issue: GitHub.