title: Why is Rails sharing code between user sessions?
body: <p>When a user tries to sign into our Rails app, I contact a 3rd party ICAM server that returns some information about the user if he exists in the ICAM server.  I get a hash back with the user name, email, etc...  (Our environment is configured in a way that the ICAM server can detect the identify of the person who is attempting to sign in based on their workstation credentials).</p>
  
  <p>We do all of this work in a custom gem.  During the login process, I try to cache the info the ICAM sever returns so I don't have to talk to the ICAM server again.  Naively, I had some code that basically did:</p>
  
  <pre><code>module Foo
    def self.store_icam_data(data)
      @icam_data = data
    end
  
    def self.icam_data
      @icam_data || {}
    end
  end
  </code></pre>
  
  <p>I just discovered a problem when two users log into the system.  When User A logs in, <code>@icam_data</code> is set with his info.  When User B logs in, <code>@icam_data</code> is set with his info.  The next time User A makes a request, <code>@icam_data</code> has  by User B's info inside it instead of User A's! </p>
  
  <p>I wasn't expecting the variable inside this module to be shared between threads/sessions like it is.  It effectively makes all current users of the system become the last user who signs in... a pretty gnarly bug.</p>
  
  <p>Can someone explain why the this @icam_data variable is getting shared across sessions? I was expecting the data/code to be more isolated than it apparently is.</p>