iHiD

# Authenticate user
@user = #...

# Destroy the existing session in case anyone is sharing it and
# create a new session that you know to be unique to the user.
reset_session

# Store the user's id as normal
session[:user_id] = @user.id

iHiD

class SettingsController < ApplicationController

  def show
    @user = User.find(session[:user_id])
  end

  def update
    @user = User.find(session[:user_id])
    @user.update_attributes(params[:settings])
  end

iHiD

Security::Application.routes.draw do
  match 'show_settings' => "settings#show"
  match 'update_settings' => "settings#update"
end

iHiD

Security::Application.routes.draw do
  get 'show_settings' => "settings#show"
  put 'update_settings' => "settings#update"
end

iHiD

Security::Application.routes.draw do
  resource :settings
end

iHiD

class User < ActiveRecord::Base
  # Has attributes: [:username, :hashed_password, :is_admin]
end

iHiD

class UsersController < ApplicationController
  #...

  def update 
    @user = User.find(params[:id])
    @user.update_attributes(params[:user])
    #...
  end

  #...

iHiD

<%= form_for @user do |f| %>

  <%= f.label :username %>
  <%= f.text_field :username %>

  <%= submit_tag %>

<% end %>

iHiD

class User < ActiveRecord::Base
  # Has attributes: [:username, :hashed_password, :is_admin]
  attr_protected :is_admin
end

iHiD

# Migration
create_table :users do |t|
  t.boolean :can_do_dangerous_things, null: false
  #...
  t.timestamps
end

class User < ActiveRecord::Base
  
  # Blacklisting attribute