# Give a user the option to stay logged in

**URL:** <https://www.ruby-forum.com/t/give-a-user-the-option-to-stay-logged-in/152491>\
**Category:** Rails\
**Created:** [November 4, 2008, 3:54pm UTC](https://www.ruby-forum.com/t/give-a-user-the-option-to-stay-logged-in/152491 "2008-11-04T15:54:22Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![johnk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/59ef9b/32.png) [@johnk](https://www.ruby-forum.com/u/johnk)\
**Post date:** [November 4, 2008, 3:54pm UTC](https://www.ruby-forum.com/t/give-a-user-the-option-to-stay-logged-in/152491/1 "2008-11-04T15:54:22Z")

</div>

I thought this would be so straight forward but it does not seem to be.  
I want to give users the option when they login to check a checkbox that  
will leave them logged in but I can not seem to figure out how.

On top of that I am trying to figure out if it matter what session store  
I  
am using. Right now I am using active record but I am looking to move  
over  
to memcache. Does it depend on session store?

I would really appreciate any input I can get on this subject!

–  
John K.  
removed\_email\_address@domain.invalid

Blog: [http://www.kopanas.com](http://www.kopanas.com)  
Conference: [http://www.cusec.net](http://www.cusec.net)  
Twits: [http://www.twitter.com/kopanas](http://www.twitter.com/kopanas)

---

<div class="post-metadata">

**Author:** ![johnk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/59ef9b/32.png) [@johnk](https://www.ruby-forum.com/u/johnk)\
**Post date:** [November 4, 2008, 4:53pm UTC](https://www.ruby-forum.com/t/give-a-user-the-option-to-stay-logged-in/152491/2 "2008-11-04T16:53:55Z")

</div>

On 4 Nov 2008, at 14:53, John K. wrote:

> I thought this would be so straight forward but it does not seem to  
> be.
> 
> I want to give users the option when they login to check a checkbox  
> that will leave them logged in but I can not seem to figure out how.
> 
> On top of that I am trying to figure out if it matter what session  
> store I am using. Right now I am using active record but I am  
> looking to move over to memcache. Does it depend on session store?

It doesn’t (since the whole point is that you want something that will  
outlast the session). Typically one stores a cookie with some sort of  
token. Restful authentication does this, you could have a look at the  
code in there.

Fred

---

<div class="post-metadata">

**Author:** ![johnk](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/59ef9b/32.png) [@johnk](https://www.ruby-forum.com/u/johnk)\
**Post date:** [November 4, 2008, 5:57pm UTC](https://www.ruby-forum.com/t/give-a-user-the-option-to-stay-logged-in/152491/3 "2008-11-04T17:57:08Z")

</div>

> I want to give users the option when they login to check a checkbox that  
> will leave them logged in but I can not seem to figure out how.

One note on this: Be aware that by doing this you are leaving your users  
more exposed to click-jacking attacks. I, personally, hate when this  
option is presented as an opt-out. It’s fine to present the option, but  
I recommend making it opt-in not opt-out. I also use an external  
password manager and never use the built-in autofill features provided  
by most modern browsers (I am using 1Password on my Mac for this, which  
I highly recommend to any Mac users out there). I enter my 1Password  
into a popup dialog, and not the actual username and password of the  
actual site, protecting me from any click-jacking attacks.

John K. wrote:

> I thought this would be so straight forward but it does not seem to be.  
> I want to give users the option when they login to check a checkbox that  
> will leave them logged in but I can not seem to figure out how.