Session-based authentication in Ruby on Rails - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is session-based authentication in Rails?

It is a way to keep a user logged in by storing their user ID in a session cookie on the browser. The server checks this session to know who the user is on each request.

beginner

How does Rails store session data by default?

Rails stores session data in a cookie on the user's browser, which is encrypted and signed to keep it secure.

beginner

What is the role of the 'session' hash in Rails controllers?

The 'session' hash lets you save and access data that persists between requests, like the current user's ID for authentication.

beginner

Why is it important to clear the session on logout?

Clearing the session removes the user's ID and other data, preventing unauthorized access if someone else uses the same browser.

intermediate

What is a common security risk with session-based authentication and how can Rails help prevent it?

Session hijacking is a risk where someone steals the session cookie. Rails helps prevent this by encrypting and signing cookies and using secure and HttpOnly flags.

In Rails, where is the session data usually stored by default?

A In an encrypted cookie on the user's browser

B In the database

C In a server-side file

D In localStorage

By default, Rails stores session data in an encrypted and signed cookie on the user's browser.

What does the 'session[:user_id]' typically store in a Rails app using session-based authentication?

A The current user's ID

B The user's password

C The user's email

D The session expiration time

The session[:user_id] stores the ID of the logged-in user to identify them on future requests.

What should happen to the session when a user logs out in a Rails app?

A Nothing, the session stays the same

B The session should be cleared or reset

C The session should be sent to the database

D The session should be saved permanently

Clearing the session on logout removes user data and prevents unauthorized access.

Which Rails method is commonly used to clear the session?

A destroy_session

B clear_session

C remove_session

D reset_session

The reset_session method clears all session data safely.

Why does Rails encrypt and sign session cookies?

A To speed up the website

B To make cookies larger

C To prevent tampering and protect user data

D To allow cookies to be shared across domains

Encryption and signing keep session cookies secure from tampering and spying.

Explain how session-based authentication works in a Rails application.

Think about what happens when a user logs in and how Rails remembers them.

Describe the security measures Rails uses to protect session data.

Consider how Rails keeps session cookies safe from theft or tampering.