Ruby-on-rails Rails：如何在会话中存储数据？

Rails: How to store data in session?

提问by cqcn1991

I'm making an writing exam practice web app in Rails. The problem is that if users' answers are submited to the Internet, they will easily be detected by ETS. So when users write their answers again in real test, ETS will think they are coping answers from Internet and give them a fairly low score.

我正在 Rails 中制作写作考试练习 Web 应用程序。问题是，如果用户的答案被提交到互联网上，他们很容易被 ETS 检测到。所以当用户在实际测试中再次写出他们的答案时，ETS 会认为他们是在应对互联网上的答案，并给他们一个相当低的分数。

My approach to this, is to store users' eassay in session. So it will not be upload to Internet at all. But, how can I store an object in session?

我对此的方法是将用户的 eassay 存储在 session 中。所以它根本不会上传到互联网。但是，如何在会话中存储对象？

回答by crispychicken

To store something in a session you can do:

要将某些内容存储在会话中，您可以执行以下操作：

session[:answer] = "some answer"

Then you can call the answer with:

然后你可以调用答案：

session[:answer]

Or you could use HTML5 localstorage:

或者你可以使用 HTML5 本地存储：

<script>
  localStorage.setItem("essay", "text");
  localStorage.getItem("essay"); // => "text"
</script>

回答by Richard Peck

1. Rails stores data in a database(doesn't have to be on the "Internet")
2. Storing lots of data in sessions is a reallybad idea

1. Rails 将数据存储在数据库中（不必在“Internet”上）
2. 在会话中存储大量数据是一个非常糟糕的主意

---

---

Sessions

会话

Rails sessionsare meant to keep consistency throughout your app

Rails 会话旨在保持整个应用程序的一致性

IMO, sessions are best used for storing "snippets" of data (such as a single object, idsetc), and are best used for these types of functions:

IMO，会话最适合用于存储数据的“片段”（例如单个对象ids等），并且最适合用于以下类型的功能：

• Shopping carts
• Security-centric systems (keeping secure data)
• Authentication (keeping a user logged in)

• 购物车
• 以安全为中心的系统（保持安全数据）
• 身份验证（保持用户登录）

---

---

Database

数据库

What you've asked is how you store people's answers in sessions

您问的是如何在会话中存储人们的答案

I would argue you should store them in a database, but secure that DB with authentication(such as Devise):

我认为您应该将它们存储在数据库中，但使用身份验证保护该数据库（例如Devise）：

#app/controllers/answers_controller.rb
def new
    @answer = Answer.new
end

def create
    @answer = Answer.new(answer_params)
    @answer.save
end

private

def answers_params
     params.require(:answer).permit(:body, :question_id).merge(user_id: current_user.id)
end 

This will allow you to store the answers in a database (the database can be on your local computer, local Intranet, or anywhere you want)

这将允许您将答案存储在数据库中（该数据库可以在您的本地计算机、本地 Intranet 或您想要的任何地方）

---

---

Security

安全

The key for you will be to secure your data

您的关键将是保护您的数据

This is called Authentication, and without going into huge detail, here's a great resource for you:

这称为Authentication，无需详细介绍，这里为您提供了一个很好的资源：

http://railscasts.com/episodes/250-authentication-from-scratch

http://railscasts.com/episodes/250-authentication-from-scratch

回答by Juri Glass

My approach to this, is to store users' eassay in session. So it will not be upload to Internet at all.

我对此的方法是在会话中存储用户的文章。所以它根本不会上传到互联网。

Technically, that is not correct. The default implementation of sessions in rails is cookie based. So if you write something to the session, it's written to a cookie on the client. With each following request to your server, the cookie is send to the server, which i assume, is somehow connected the internet.

从技术上讲，这是不正确的。rails 中会话的默认实现是基于 cookie 的。因此，如果您向会话写入某些内容，则会将其写入客户端上的 cookie。随着对您的服务器的每个后续请求，cookie 被发送到我认为以某种方式连接到互联网的服务器。

Also, cookies and therefore sessions, are restricted in size (about 4kb). So you might not be able to store everything in a session.

此外，cookie 和会话的大小也受到限制（大约 4kb）。因此，您可能无法在会话中存储所有内容。

The problem is that if users' answers are submited to the Internet, they will easily be detected by ETS

问题是，如果用户的答案被提交到互联网上，他们很容易被 ETS 检测到

That's the real question here:

这是真正的问题：

Usually, if one doesn't want that other people (e.g. the ETS) can read your content, you restrict the access to the content. Either by passwords or by other means.

通常，如果不希望其他人（例如 ETS）可以阅读您的内容，您可以限制对内容的访问。通过密码或其他方式。

So, use some sort of authentication (answer by @Rich Peck), be extra careful that your content is only visible after an successful authentication, don't give the passwords to the ETS and you should be fine.

因此，请使用某种身份验证（@Rich Peck 的回答），要格外小心，确保您的内容仅在成功身份验证后可见，不要将密码提供给 ETS，您应该没问题。