---
title: "Implementation of “Remember me” in a Rails application"  
description: "Implementation of “Remember me” in a Rails application"  
author: "Anonymous User"  
published: 2014-12-28  
updated: 2014-12-28  
canonical: https://www.mindstick.com/forum/12821/implementation-of-remember-me-in-a-rails-application  
category: "ruby on rails"  
tags: ["ruby on rails", "ruby", "http"]  
reading_time: 2 minutes  

---

# Implementation of “Remember me” in a Rails application

My Rails-app has a sign in box with a "remember me" checkbox. [Users](https://www.mindstick.com/news/2244/issue-preventing-users-from-accessing-facebook-s-social-networking-platforms-has-been-resolved) who [check](https://yourviews.mindstick.com/story/2248/never-forget-to-check-these-specifications-before-buying-a-mobile-phone) that box should remain logged in even after closing their browser. I'm keeping track of whether users are logged in by storing their id in the user's [session](https://www.mindstick.com/articles/12042/session-in-c-sharp).\
But [sessions](https://answers.mindstick.com/qa/44945/where-do-i-get-information-on-the-sessions-of-lok-sabha) are implemented in Rails as session [cookies](https://www.mindstick.com/articles/12044/cookies-in-c-sharp), which are not [persistent](https://www.mindstick.com/interview/22840/what-is-the-use-of-persistent-store-coordinator-in-core-data). I can make them persistent:\
\
[class](https://www.mindstick.com/blog/165/generic-class-in-c-sharp) ApplicationController < ActionController::Base before_filter :update_session_expiration_date\
[private](https://www.mindstick.com/blog/11097/java-access-modifiers-the-public-and-the-private-modifiers)\
def update_session_expiration_date [options](https://www.mindstick.com/articles/43878/making-the-best-use-of-the-options-trade-ideas) = ActionController::Base.session_options unless options[:session_expires] options[:session_expires] = 1.year.from_now end end endBut that seems like a hack, which is surprising for such [common](https://www.mindstick.com/articles/23170/10-most-common-accounting-mistakes-of-small-business) functionality. Is there a better way?\

## Replies

### Reply by Anonymous User

I have spent a while thinking about this and came to some conclusions. Rails session cookies are tamper-proof by default, so you really don't have to worry about a cookie being modified on the client end.\
Here is what I've done:\
Session cookie is set to be long-lived (6 months or so)Inside the session storeAn 'expires on' date that is set to login + 24 hoursuser idAuthenticated = true so I can allow for anonymous user sesssions (not dangerous because of the cookie tamper protection)I add a before_filter in the Application Controller that checks the 'expires on' part of the session.When the user checks the "Remember Me" box, I just set the session[:expireson] date to be login + 2 weeks. No one can steal the cookie and stay logged in forever or masquerade as another user because the rails session cookie is tamper-proof.


---

Original Source: https://www.mindstick.com/forum/12821/implementation-of-remember-me-in-a-rails-application

Copyright © MindStick Software Pvt. Ltd. This Markdown version is provided for developers, AI systems, and offline reading.