Rails 3 - authenticate and :before_filter

I am a newbie in Rails. I try to build a simple authenticate system, to application_controller I put following lines:

  def check_session
    if session[:user]
      if session[:expiry_time] < 10.minutes.ago
        reset_session
      flash[:warning] = 'You was logout.' 
        redirect_to root_url
      else
        session[:expiry_time] 开发者_运维知识库= Time.now
      end
    else
      #... authenticate
      session[:expiry_time] = Time.now
      flash[:warning] = 'You was logout.' 
      redirect_to root_url
    end
  end  

My problem is in one action - in this action I check, if the user is log in or not. And if the user is log in, so I will render one template, and if not, so I will render the second one. It looks like:

<% unless session[:user].nil? %>
  <%= render :template => 'template_for_login_user' %>
<% else %>
  <%= render :template => 'template_for_not_login_user' %>
<% end %>

And here is the problem - this doesn't works me. At least... well - if I am not log in, so will be render the template template_for_not_login_user and if I am, so template_for_login_user. This is right.

But if I am log in and I am on the template_for_login_user, but I am 15min idle => the session will be expired => I should be redirect to login form. But here is the problem - I am 15 minutes idle and I refresh this page, so I am still on the action template_for_login_user - and this is the problem...

I would like to ask you - can you help me please, where could be a problem? What I'm doing wrong?

---

In your ApplicationController, did you add a line like this :

before_filter :check_session

if some controller action don't need the user to be authenticated, you can add this:

skip_before_filter :check_session, :only=> [:index, :search, etc..]

in this example, this would skip your before_filter :check_session on action : index and search. This way you have a global behavior that always check the session for a user logged on. But you can skip this in particular controller where some actions don't need the user to be authenticated