Remember me functionality in Ruby on Rails - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ component_behavior

intermediate

How does the 'remember me' feature keep a user logged in?

In a Rails app, when a user selects 'remember me' during login, what mechanism keeps them logged in across browser sessions?

A It stores a permanent cookie with a unique token linked to the user in the database.

B It saves the user's password in a cookie for automatic login.

C It uses session cookies that expire when the browser closes.

D It stores the user's email in local storage without any token.

💡 Hint

Think about how Rails securely identifies a user without storing sensitive info directly in cookies.

The 'remember me' feature uses a permanent cookie containing a secure token. This token matches a digest stored in the database, allowing Rails to authenticate the user automatically on future visits without asking for credentials again.

📝 Syntax

intermediate

Identify the correct way to set a permanent signed cookie in Rails

Which code snippet correctly sets a permanent signed cookie named remember_token with value token?

A cookies.signed[:remember_token] = { value: token, expires: 20.years.from_now }

B cookies.permanent.signed[:remember_token] = token

C cookies.permanent[:remember_token] = { signed: token }

D cookies[:remember_token] = { value: token, expires: 1.hour.from_now }

💡 Hint

Remember the chaining order for setting permanent and signed cookies in Rails.

In Rails, cookies.permanent.signed[:key] sets a cookie that is both permanent (expires 20 years later) and signed (encrypted to prevent tampering). Option B uses this correct chaining.

🔧 Debug

advanced

Why does the 'remember me' cookie not persist after browser restart?

Given this code snippet in a Rails app, users report that the 'remember me' cookie disappears after closing the browser. What is the likely cause?

cookies[:remember_token] = user.remember_token

A The user.remember_token is nil, so no cookie is set.

B The cookie value is not signed, causing it to be rejected by the browser.

C The cookie name is invalid and ignored by Rails.

D The cookie is not set as permanent, so it expires when the browser closes.

💡 Hint

Think about the difference between session cookies and permanent cookies.

By default, cookies set without permanent expire when the browser session ends. To persist across sessions, the cookie must be set as permanent.

❓ state_output

advanced

What is the value of current_user after browser restart with 'remember me' enabled?

In a Rails app with 'remember me' implemented, after closing and reopening the browser, what will current_user be if the remember token cookie is valid?

A Nil, because session data is lost after browser restart.

B An empty user object with no attributes set.

C The user object corresponding to the remember token cookie.

D An error is raised because the session is missing.

💡 Hint

Consider how the app uses the remember token cookie to restore user state.

The app reads the remember token from the cookie, finds the matching user in the database, and sets current_user accordingly, even if the session was lost.

🧠 Conceptual

expert

Why is storing the user's password in a cookie a bad idea for 'remember me'?

Why should a Rails app never store the user's password directly in a cookie for 'remember me' functionality?

A Because cookies can be intercepted or accessed by attackers, exposing the password risks account compromise.

B Because storing passwords in cookies causes the browser to crash.

C Because Rails does not support storing strings in cookies.

D Because passwords in cookies expire too quickly to be useful.

💡 Hint

Think about security risks of storing sensitive data on the client side.

Cookies can be stolen or read by malicious actors. Storing passwords directly exposes users to theft and unauthorized access. Instead, apps store secure tokens that can be revoked.