Remember me functionality in Ruby on Rails - Step-by-Step Execution

Concept Flow - Remember me functionality

User logs in

↓

Check 'Remember me' box?

No→Create session only

Yes↓

Generate remember token

↓

Store token digest in DB

↓

Store token in cookie

↓

User closes browser

↓

User returns

↓

Check cookie token

↓

Match token with DB digest?

No→Ask to login

Yes↓

Log user in automatically

This flow shows how the app remembers a user by storing a token in a cookie and matching it with the database to keep the user logged in.

Execution Sample

Ruby on Rails

def remember(user)
  user.remember
  cookies.permanent.signed[:user_id] = user.id
  cookies.permanent[:remember_token] = user.remember_token
end

This code sets a permanent signed cookie with the user ID and a remember token cookie to keep the user logged in.

Execution Table

Step	Action	Token Generated	Cookie Set	DB Updated	Result
1	User logs in and checks 'Remember me'	No token yet	No cookies	No DB change	Waiting for token generation
2	Generate remember token	Token123abc	No cookies yet	No DB change	Token ready
3	Store token digest in DB	Token123abc	No cookies yet	Digest stored	DB updated with token digest
4	Set cookies with user_id and token	Token123abc	Cookies set with user_id and token	Digest stored	Cookies saved on browser
5	User closes browser	Token123abc	Cookies persist (permanent)	Digest stored	User session saved
6	User returns, app reads cookies	Token123abc	Cookies read	Digest stored	Token retrieved from cookie
7	Compare cookie token with DB digest	Token123abc	Cookies read	Digest stored	Tokens match
8	Log user in automatically	Token123abc	Cookies read	Digest stored	User logged in without password
9	If tokens did not match	Token123abc	Cookies read	Digest stored	User asked to login manually

💡 Execution stops after user is logged in automatically or asked to login if tokens don't match.

Variable Tracker

Variable	Start	After Step 2	After Step 3	After Step 4	After Step 6	Final
remember_token	nil	Token123abc	Token123abc	Token123abc	Token123abc	Token123abc
cookies[:user_id]	nil	nil	nil	user.id	user.id	user.id
cookies[:remember_token]	nil	nil	nil	Token123abc	Token123abc	Token123abc
DB remember_digest	nil	nil	Digest(Token123abc)	Digest(Token123abc)	Digest(Token123abc)	Digest(Token123abc)

Key Moments - 3 Insights

Why do we store a digest of the token in the database instead of the token itself?

Storing the digest protects user security because the actual token is only in the cookie. If the database is leaked, attackers can't use the digest to log in. See step 3 in execution_table where digest is stored, not the token.

What happens if the user clears cookies but the database still has the token digest?

The user will have no token cookie to match, so the app will ask them to log in again. This is shown in step 9 where tokens don't match or cookie is missing.

Why do we use permanent cookies for 'Remember me'?

Permanent cookies stay after the browser closes, so the user stays logged in next time. This is shown in step 5 where cookies persist after closing the browser.

Visual Quiz - 3 Questions

Look at the execution_table at step 4. What cookies are set in the user's browser?

A Only remember_token cookie

B Both user_id and remember_token cookies

C Only user_id cookie

D No cookies are set yet

💡 Hint

Check the 'Cookie Set' column at step 4 in execution_table.

At which step does the app compare the token from the cookie with the database digest?

A Step 7

B Step 5

C Step 2

D Step 9

💡 Hint

Look for the step mentioning 'Compare cookie token with DB digest' in execution_table.

If the user does NOT check 'Remember me' at login, what changes in the flow?

A Token is generated but not stored

B Token is stored but cookies are session-only

C No token is generated and no cookies are set permanently

D User is logged out immediately

💡 Hint

Refer to the decision after 'Check Remember me box?' in concept_flow.

Concept Snapshot

Remember me functionality in Rails:
- Generate a secure token when user opts in
- Store token digest in DB, token in permanent cookie
- On return, compare cookie token with DB digest
- If match, log user in automatically
- Protects user convenience and security

Full Transcript

This visual execution trace shows how the 'Remember me' feature works in Rails. When a user logs in and checks 'Remember me', the app generates a secure token and stores its digest in the database. It sets permanent cookies with the user ID and token. When the user returns, the app reads the cookies and compares the token with the digest in the database. If they match, the user is logged in automatically without entering credentials again. If not, the user must log in manually. This process balances user convenience with security by storing only the token digest in the database and the actual token in the user's browser cookie.

Practice

1. What is the main purpose of the remember me functionality in a Rails application?

easy

A. To reset the user's password automatically

B. To keep users logged in by saving a cookie on their browser

C. To log out users after a short time

D. To encrypt all user data in the database

Solution

1. Step 1: Understand the purpose of remember me

   The remember me feature is designed to keep users logged in even after they close their browser by saving a cookie.

2. Step 2: Identify the correct description

   Options B, C, and D describe unrelated features like password reset, forced logout, or data encryption, which are not the purpose of remember me.

3. Final Answer:

   To keep users logged in by saving a cookie on their browser -> Option B

4. Quick Check:

   Remember me = save cookie to stay logged in [OK]

Hint: Remember me means saving login info in a cookie [OK]

Common Mistakes:

• Confusing remember me with password reset
• Thinking it logs out users quickly
• Assuming it encrypts database data

2. Which of the following is the correct way to set a permanent signed cookie for remember me in Rails?

easy

A. cookies.signed[:user_id] = { value: user.id, expires: 20.years.from_now }

B. cookies[:user_id] = { value: user.id, expires: 1.hour.from_now }

C. session[:user_id] = user.id

D. cookies.permanent[:user_id] = user.id

Solution

1. Step 1: Understand permanent signed cookies

   Permanent signed cookies in Rails are set with cookies.signed and an expiration far in the future, like 20 years.

2. Step 2: Analyze options

   cookies[:user_id] = { value: user.id, expires: 1.hour.from_now } sets a cookie but expires in 1 hour, not permanent. session[:user_id] = user.id uses session, not cookie. cookies.permanent[:user_id] = user.id sets a permanent cookie but not signed, which is less secure.

3. Final Answer:

   cookies.signed[:user_id] = { value: user.id, expires: 20.years.from_now } -> Option A

4. Quick Check:

   Permanent signed cookie = cookies.signed with long expiry [OK]

Hint: Use cookies.signed with long expiry for remember me [OK]

Common Mistakes:

• Using session instead of cookies
• Setting short expiry for permanent cookie
• Not signing the cookie for security

3. Given this Rails controller code snippet for login:

def create
  user = User.find_by(email: params[:email])
  if user&.authenticate(params[:password])
    if params[:remember_me] == '1'
      cookies.permanent.signed[:user_id] = user.id
    else
      session[:user_id] = user.id
    end
    redirect_to root_path
  else
    render :new
  end
end

What happens if the user checks the 'remember me' box?

medium

A. User ID is saved only in the session and lost on browser close

B. User password is saved in a cookie

C. User is logged out immediately

D. User ID is saved in a permanent signed cookie to keep logged in

Solution

1. Step 1: Check the remember_me condition

   If params[:remember_me] == '1', the code sets cookies.permanent.signed[:user_id] = user.id, which saves a permanent signed cookie.

2. Step 2: Understand cookie effect

   This cookie keeps the user logged in even after closing the browser, unlike session which clears on close.

3. Final Answer:

   User ID is saved in a permanent signed cookie to keep logged in -> Option D

4. Quick Check:

   Remember me checked = permanent signed cookie set [OK]

Hint: Remember me checked sets permanent signed cookie [OK]

Common Mistakes:

• Thinking session is used when remember me is checked
• Assuming password is saved in cookie
• Believing user logs out immediately

4. Identify the bug in this logout method related to remember me functionality:

def destroy
  session.delete(:user_id)
  cookies.delete(:user_id)
  redirect_to login_path
end

medium

A. It does not clear the user's password

B. It deletes the cookie but not the session

C. It deletes the session but forgets to delete the signed cookie

D. It redirects to the wrong path

Solution

1. Step 1: Check what is deleted

   The method deletes session[:user_id] and cookies[:user_id], but the remember me cookie is usually a signed cookie.

2. Step 2: Understand cookie deletion

   Deleting cookies[:user_id] does not remove cookies.signed[:user_id]. The signed cookie remains, so user stays logged in.

3. Final Answer:

   It deletes the session but forgets to delete the signed cookie -> Option C

4. Quick Check:

   Logout must delete signed cookie too [OK]

Hint: Delete signed cookie on logout, not just plain cookie [OK]

Common Mistakes:

• Deleting only session but not signed cookie
• Deleting wrong cookie key
• Not redirecting after logout

5. You want to implement a secure remember me feature that expires after 2 weeks and invalidates on logout. Which approach is best?

hard

A. Set cookies.signed[:user_id] with 2 weeks expiry and delete it on logout

B. Store user ID in session only and never use cookies

C. Save user password in a permanent cookie for quick login

D. Use a plain cookie without signing or expiry

Solution

1. Step 1: Choose secure cookie with expiry

   Using cookies.signed[:user_id] with a 2 weeks expiry ensures the cookie is secure and expires reasonably.

2. Step 2: Invalidate cookie on logout

   Deleting this cookie on logout prevents unauthorized access after user logs out.

3. Final Answer:

   Set cookies.signed[:user_id] with 2 weeks expiry and delete it on logout -> Option A

4. Quick Check:

   Secure signed cookie + expiry + delete on logout = best practice [OK]

Hint: Use signed cookie with expiry and delete on logout [OK]

Common Mistakes:

• Storing password in cookie (insecure)
• Using session only (no persistence after close)
• Using unsigned or permanent cookies without expiry