Remember me functionality in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

How does the 'remember me' feature keep a user logged in?

In a Rails app, when a user selects 'remember me' during login, what mechanism keeps them logged in across browser sessions?

A It stores a permanent cookie with a unique token linked to the user in the database.

B It saves the user's password in a cookie for automatic login.

C It uses session cookies that expire when the browser closes.

D It stores the user's email in local storage without any token.

💡 Hint

Think about how Rails securely identifies a user without storing sensitive info directly in cookies.

The 'remember me' feature uses a permanent cookie containing a secure token. This token matches a digest stored in the database, allowing Rails to authenticate the user automatically on future visits without asking for credentials again.

📝 Syntax

intermediate

Identify the correct way to set a permanent signed cookie in Rails

Which code snippet correctly sets a permanent signed cookie named remember_token with value token?

A cookies.signed[:remember_token] = { value: token, expires: 20.years.from_now }

B cookies.permanent.signed[:remember_token] = token

C cookies.permanent[:remember_token] = { signed: token }

D cookies[:remember_token] = { value: token, expires: 1.hour.from_now }

💡 Hint

Remember the chaining order for setting permanent and signed cookies in Rails.

In Rails, cookies.permanent.signed[:key] sets a cookie that is both permanent (expires 20 years later) and signed (encrypted to prevent tampering). Option B uses this correct chaining.

🔧 Debug

advanced

Why does the 'remember me' cookie not persist after browser restart?

Given this code snippet in a Rails app, users report that the 'remember me' cookie disappears after closing the browser. What is the likely cause?

cookies[:remember_token] = user.remember_token

A The user.remember_token is nil, so no cookie is set.

B The cookie value is not signed, causing it to be rejected by the browser.

C The cookie name is invalid and ignored by Rails.

D The cookie is not set as permanent, so it expires when the browser closes.

💡 Hint

Think about the difference between session cookies and permanent cookies.

By default, cookies set without permanent expire when the browser session ends. To persist across sessions, the cookie must be set as permanent.

❓ state_output

advanced

What is the value of current_user after browser restart with 'remember me' enabled?

In a Rails app with 'remember me' implemented, after closing and reopening the browser, what will current_user be if the remember token cookie is valid?

A Nil, because session data is lost after browser restart.

B An empty user object with no attributes set.

C The user object corresponding to the remember token cookie.

D An error is raised because the session is missing.

💡 Hint

Consider how the app uses the remember token cookie to restore user state.

The app reads the remember token from the cookie, finds the matching user in the database, and sets current_user accordingly, even if the session was lost.

🧠 Conceptual

expert

Why is storing the user's password in a cookie a bad idea for 'remember me'?

Why should a Rails app never store the user's password directly in a cookie for 'remember me' functionality?

A Because cookies can be intercepted or accessed by attackers, exposing the password risks account compromise.

B Because storing passwords in cookies causes the browser to crash.

C Because Rails does not support storing strings in cookies.

D Because passwords in cookies expire too quickly to be useful.

💡 Hint

Think about security risks of storing sensitive data on the client side.

Cookies can be stolen or read by malicious actors. Storing passwords directly exposes users to theft and unauthorized access. Instead, apps store secure tokens that can be revoked.

Practice

1. What is the main purpose of the remember me functionality in a Rails application?

easy

A. To reset the user's password automatically

B. To keep users logged in by saving a cookie on their browser

C. To log out users after a short time

D. To encrypt all user data in the database

Solution

1. Step 1: Understand the purpose of remember me

   The remember me feature is designed to keep users logged in even after they close their browser by saving a cookie.

2. Step 2: Identify the correct description

   Options B, C, and D describe unrelated features like password reset, forced logout, or data encryption, which are not the purpose of remember me.

3. Final Answer:

   To keep users logged in by saving a cookie on their browser -> Option B

4. Quick Check:

   Remember me = save cookie to stay logged in [OK]

Hint: Remember me means saving login info in a cookie [OK]

Common Mistakes:

• Confusing remember me with password reset
• Thinking it logs out users quickly
• Assuming it encrypts database data

2. Which of the following is the correct way to set a permanent signed cookie for remember me in Rails?

easy

A. cookies.signed[:user_id] = { value: user.id, expires: 20.years.from_now }

B. cookies[:user_id] = { value: user.id, expires: 1.hour.from_now }

C. session[:user_id] = user.id

D. cookies.permanent[:user_id] = user.id

Solution

1. Step 1: Understand permanent signed cookies

   Permanent signed cookies in Rails are set with cookies.signed and an expiration far in the future, like 20 years.

2. Step 2: Analyze options

   cookies[:user_id] = { value: user.id, expires: 1.hour.from_now } sets a cookie but expires in 1 hour, not permanent. session[:user_id] = user.id uses session, not cookie. cookies.permanent[:user_id] = user.id sets a permanent cookie but not signed, which is less secure.

3. Final Answer:

   cookies.signed[:user_id] = { value: user.id, expires: 20.years.from_now } -> Option A

4. Quick Check:

   Permanent signed cookie = cookies.signed with long expiry [OK]

Hint: Use cookies.signed with long expiry for remember me [OK]

Common Mistakes:

• Using session instead of cookies
• Setting short expiry for permanent cookie
• Not signing the cookie for security

3. Given this Rails controller code snippet for login:

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    if params[:remember_me] == '1'
      cookies.permanent.signed[:user_id] = user.id
    else
      session[:user_id] = user.id
    end
    redirect_to root_path
  else
    render :new
  end
end

What happens if the user checks the 'remember me' box?

medium

A. User ID is saved only in the session and lost on browser close

B. User password is saved in a cookie

C. User is logged out immediately

D. User ID is saved in a permanent signed cookie to keep logged in

Solution

1. Step 1: Check the remember_me condition

   If params[:remember_me] == '1', the code sets cookies.permanent.signed[:user_id] = user.id, which saves a permanent signed cookie.

2. Step 2: Understand cookie effect

   This cookie keeps the user logged in even after closing the browser, unlike session which clears on close.

3. Final Answer:

   User ID is saved in a permanent signed cookie to keep logged in -> Option D

4. Quick Check:

   Remember me checked = permanent signed cookie set [OK]

Hint: Remember me checked sets permanent signed cookie [OK]

Common Mistakes:

• Thinking session is used when remember me is checked
• Assuming password is saved in cookie
• Believing user logs out immediately

4. Identify the bug in this logout method related to remember me functionality:

def destroy
  session.delete(:user_id)
  cookies.delete(:user_id)
  redirect_to login_path
end

medium

A. It does not clear the user's password

B. It deletes the cookie but not the session

C. It deletes the session but forgets to delete the signed cookie

D. It redirects to the wrong path

Solution

1. Step 1: Check what is deleted

   The method deletes session[:user_id] and cookies[:user_id], but the remember me cookie is usually a signed cookie.

2. Step 2: Understand cookie deletion

   Deleting cookies[:user_id] does not remove cookies.signed[:user_id]. The signed cookie remains, so user stays logged in.

3. Final Answer:

   It deletes the session but forgets to delete the signed cookie -> Option C

4. Quick Check:

   Logout must delete signed cookie too [OK]

Hint: Delete signed cookie on logout, not just plain cookie [OK]

Common Mistakes:

• Deleting only session but not signed cookie
• Deleting wrong cookie key
• Not redirecting after logout

5. You want to implement a secure remember me feature that expires after 2 weeks and invalidates on logout. Which approach is best?

hard

A. Set cookies.signed[:user_id] with 2 weeks expiry and delete it on logout

B. Store user ID in session only and never use cookies

C. Save user password in a permanent cookie for quick login

D. Use a plain cookie without signing or expiry

Solution

1. Step 1: Choose secure cookie with expiry

   Using cookies.signed[:user_id] with a 2 weeks expiry ensures the cookie is secure and expires reasonably.

2. Step 2: Invalidate cookie on logout

   Deleting this cookie on logout prevents unauthorized access after user logs out.

3. Final Answer:

   Set cookies.signed[:user_id] with 2 weeks expiry and delete it on logout -> Option A

4. Quick Check:

   Secure signed cookie + expiry + delete on logout = best practice [OK]

Hint: Use signed cookie with expiry and delete on logout [OK]

Common Mistakes:

• Storing password in cookie (insecure)
• Using session only (no persistence after close)
• Using unsigned or permanent cookies without expiry