{"record":{"id":"8fa43cf17933968a","repo":"RailsApps/rails-composer","slug":"access-denied","errorCode":null,"errorMessage":"Access denied.","messagePattern":"Access denied\\.","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"files/app/controllers/application_controller-omniauth.rb","lineNumber":23,"sourceCode":"  helper_method :correct_user?\n\n  private\n    def current_user\n      begin\n        @current_user ||= User.find(session[:user_id]) if session[:user_id]\n      rescue Exception => e\n        nil\n      end\n    end\n\n    def user_signed_in?\n      return true if current_user\n    end\n\n    def correct_user?\n      @user = User.find(params[:id])\n      unless current_user == @user\n        redirect_to root_url, :alert => \"Access denied.\"\n      end\n    end\n\n    def authenticate_user!\n      if !current_user\n        redirect_to root_url, :alert => 'You need to sign in for access to this page.'\n      end\n    end\n\nend\n","sourceCodeStart":5,"sourceCodeEnd":34,"githubUrl":"https://github.com/RailsApps/rails-composer/blob/5a9985f6ddae1cc9475568c2d1f6a7ae28c005a7/files/app/controllers/application_controller-omniauth.rb#L5-L34","documentation":"Error \"Access denied.\" thrown in RailsApps/rails-composer.","triggerScenarios":"Shown as a redirect alert when correct_user? finds that the signed-in user does not match the User record loaded from params[:id], e.g. a user attempts to open another user account page.","commonSituations":"A signed-in user edits the :id in the URL to another user id; a stale link points to a page owned by a different account; the correct_user? before_filter is applied to an action that should not require record ownership.","solutions":["Apply the correct_user? before_filter only to actions that operate on the record owned by the current user.","Verify that session[:user_id] is set at login so current_user can match @user.","If privileged roles must access other records, extend the check: unless current_user == @user || current_user.admin?"],"exampleFix":"def correct_user?\n  @user = User.find(params[:id])\n  unless current_user == @user\n    redirect_to root_url, :alert => \"Access denied.\"\n  end\nend\nbefore_filter :correct_user?, :only => [:edit, :update]","handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"5a9985f6ddae1cc9475568c2d1f6a7ae28c005a7","analyzedAt":"2026-08-23T12:10:37.735Z","schemaVersion":2},"datasetVersion":"2026-08-23T16:17:53.355Z"}