# MiniProfiler 在登录操作上的初始化会强制 Guardian 在整个请求期间将 AnonymousUser 缓存（memoized）

**URL:** <https://meta.discourse.org/t/miniprofiler-initialization-on-login-action-forces-guardian-to-be-memoized-with-anonymoususer-for-duration-of-request/99851>\
**Category:** Bug\
**Created:** [2018年十月18日 10:48 UTC](https://meta.discourse.org/t/miniprofiler-initialization-on-login-action-forces-guardian-to-be-memoized-with-anonymoususer-for-duration-of-request/99851 "2018-10-18T10:48:52Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![ptrippett](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ptrippett/32/110352_2.png) [@ptrippett](https://meta.discourse.org/u/ptrippett)\
**Post date:** [2018年十月18日 10:48 UTC](https://meta.discourse.org/t/miniprofiler-initialization-on-login-action-forces-guardian-to-be-memoized-with-anonymoususer-for-duration-of-request/99851/1 "2018-10-18T10:48:52Z")

</div>

> <https://github.com/discourse/discourse/blob/main/app/controllers/application_controller.rb#L631>

The above code is called on all page requests to discourse. The problem arises that `guardian` is a lazy-loaded memoized variable which at this point during login in the call is just a representation of an Anonymous user because the user login has not yet been attempted and thus failed or succeeded. When the success login response is rendered the memoized variable for guardian is still used and thus returns policies based on an anonymous user and not the policies for the user we just logged in as.

The result of a login serialises the current user to json and conditionally adds fields based on the policies returned by guardian. One of the policies is `can_edit` of which an anonymous user can not edit the current users record, however the actual user logged in should be able to edit their own user account and if the `guardian` variable is replaced with an instance of the currently logged in user then the json returns `can_edit` to be true as it should.

I am more than happy to PR a fix but theres a couple of ways to fix this, and I wanted to know if there was a deeper less hacky way to fix this deeper in the depths of Discourse short of just adding `@guardian = nil` to `def log_in` 😂

Current workaround is to set the environment variable `DISCOURSE_LOAD_MINI_PROFILER=false`

---

<div class="post-metadata">

**Author:** ![sam](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/sam/32/102149_2.png) [@sam](https://meta.discourse.org/u/sam)\
**Post date:** [2018年十月18日 11:00 UTC](https://meta.discourse.org/t/miniprofiler-initialization-on-login-action-forces-guardian-to-be-memoized-with-anonymoususer-for-duration-of-request/99851/2 "2018-10-18T11:00:47Z")

</div>

Wait so this is just an issue directly after login and then a reload makes it go away? A fix + test is certainly welcome

---

<div class="post-metadata">

**Author:** ![ptrippett](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/ptrippett/32/110352_2.png) [@ptrippett](https://meta.discourse.org/u/ptrippett)\
**Post date:** [2018年十月18日 11:04 UTC](https://meta.discourse.org/t/miniprofiler-initialization-on-login-action-forces-guardian-to-be-memoized-with-anonymoususer-for-duration-of-request/99851/3 "2018-10-18T11:04:09Z")

</div>

Yes, I only noticed it because a plugin i am writing uses the json returned by the login endpoint and can\_edit was always false in the returned json.