Implementation of "Remember me" in a Rails application

Ruby on-RailsRubyHttp

Ruby on-Rails Problem Overview

My Rails-app has a sign in box with a "remember me" checkbox. Users who check that box should remain logged in even after closing their browser. I'm keeping track of whether users are logged in by storing their id in the user's session.

But sessions are implemented in Rails as session cookies, which are not persistent. I can make them persistent:

class ApplicationController < ActionController::Base
  before_filter :update_session_expiration_date


  def update_session_expiration_date
    options = ActionController::Base.session_options
    unless options[:session_expires]
      options[:session_expires] = 1.year.from_now

But that seems like a hack, which is surprising for such common functionality. Is there any better way?


Gareth's answer is pretty good, but I would still like an answer from someone familiar with Rails 2 (because of it's unique CookieSessionStore).

Ruby on-Rails Solutions

Solution 1 - Ruby on-Rails

You should almost certainly not be extending the session cookie to be long lived.

Although not dealing specifically with rails this article goes to some length to explain 'remember me' best practices.

In summary though you should:

  • Add an extra column to the user table to accept a large random value
  • Set a long lived cookie on the client which combines the user id and the random value
  • When a new session starts, check for the existence of the id/value cookie and authenticate the new user if they match.

The author also recommends invalidating the random value and resetting the cookie at every login. Personally I don't like that as you then can't stay logged into a site on two computers. I would tend to make sure my password changing function also reset the random value thus locking out sessions on other machines.

As a final note, the advice he gives on making certain functions (password change/email change etc) unavailable to auto authenticated sessions is well worth following but rarely seen in the real world.

Solution 2 - Ruby on-Rails

I have spent a while thinking about this and came to some conclusions. Rails session cookies are tamper-proof by default, so you really don't have to worry about a cookie being modified on the client end.

Here is what I've done:

  • Session cookie is set to be long-lived (6 months or so)
  • Inside the session store
    • An 'expires on' date that is set to login + 24 hours
    • user id
    • Authenticated = true so I can allow for anonymous user sesssions (not dangerous because of the cookie tamper protection)
  • I add a before_filter in the Application Controller that checks the 'expires on' part of the session.

When the user checks the "Remember Me" box, I just set the session[:expireson] date to be login + 2 weeks. No one can steal the cookie and stay logged in forever or masquerade as another user because the rails session cookie is tamper-proof.

Solution 3 - Ruby on-Rails

I would suggest that you either take a look at the RESTful_Authentication plug in, which has an implementation of this, or just switch your implementation to use the RESTful Authentication_plugin. There is a good explanation about how to use this plug in at Railscasts:

railscasts #67 restful_authentication

Here is a link to the plugin itself


Solution 4 - Ruby on-Rails

The restful_authentication plugin has a good implementation of this:


Solution 5 - Ruby on-Rails

Note that you don't want to persist their session, just their identity. You'll create a fresh session for them when they return to your site. Generally you just assign a GUID to the user, write that to their cookie, then use it to look them up when they come back. Don't use their login name or user ID for the token as it could easily be guessed and allow crafty visitors to hijack other users' accounts.

Solution 6 - Ruby on-Rails

This worked like a charm for me:

Now my CookieStore sessions expire after two weeks, whereby the user must submit their login credentials again in order to be persistently logged-in for another two weeks.

Bascially, it's as simple as:

  1. including one file in vendor/plugins directory
  2. set session expiry value in application controller using just one line

Solution 7 - Ruby on-Rails

I would go for Devise for a brilliant authentication solution for rails.


All content for this solution is sourced from the original question on Stackoverflow.

The content on this page is licensed under the Attribution-ShareAlike 4.0 International (CC BY-SA 4.0) license.

Content TypeOriginal AuthorOriginal Content on Stackoverflow
QuestionMichiel de MareView Question on Stackoverflow
Solution 1 - Ruby on-RailsGareth SimpsonView Answer on Stackoverflow
Solution 2 - Ruby on-RailsDaniel BeardsleyView Answer on Stackoverflow
Solution 3 - Ruby on-RailsMattewView Answer on Stackoverflow
Solution 4 - Ruby on-RailsJarin UdomView Answer on Stackoverflow
Solution 5 - Ruby on-RailsTeflon TedView Answer on Stackoverflow
Solution 6 - Ruby on-RailsAllan L.View Answer on Stackoverflow
Solution 7 - Ruby on-RailsVedView Answer on Stackoverflow