# Keeping users logged in between browser launches

**URL:** <https://www.ruby-forum.com/t/keeping-users-logged-in-between-browser-launches/154071>\
**Category:** Rails\
**Created:** [November 25, 2008, 2:09am UTC](https://www.ruby-forum.com/t/keeping-users-logged-in-between-browser-launches/154071 "2008-11-25T02:09:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![skaufman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8e7dd6/32.png) [@skaufman](https://www.ruby-forum.com/u/skaufman)\
**Post date:** [November 25, 2008, 2:09am UTC](https://www.ruby-forum.com/t/keeping-users-logged-in-between-browser-launches/154071/1 "2008-11-25T02:09:31Z")

</div>

I’ve got several several Rails 2.1 apps using a variant of  
restful\_authentication to manage logins/sessions (actually the guts  
from Beast but it’s basically restful\_authentication). The apps store  
sessions in cookies per 2.1 default. The apps set two cookies – the  
session cookie and a “login\_token” cookie that gets set thus:

cookies[:login\_token] = {:value =\> “#{current\_user.id};#  
{current\_user.reset\_login\_key!}”, :expires =\> 1.year.from\_now.utc} if  
params[:remember\_me] == “1”

The problem is that logged-in users who then close their browsers have  
to re-login when they re-launch their browsers even when the browsers  
are set to keep cookies until they expire – which shouldn’t happen  
because the login\_token cookie expires one year in the future. When  
their browsers are left open, the users remain logged in and the sites  
function perfectly normally. Checking these cookies in the browser  
confirms that the appear to be set/sent correctly.

What could cause this behavior? I’ve thought of:

- session storage location – but moving sessions back to  
active\_record doesn’t fix this
- login\_token cookie lacks a :domain setting – but setting this  
resulted in the login\_token no longer showing up in the browser and  
didn’t affect the problem
- mongrel\_cluster – the sites where this problem happens are running  
mongrel\_clusters with several mongrels each – while I have one site  
where the login persists as expected and has only a single mongrel in  
front of it – but otherwise uses the same login/session code

Could this really be a mongrel\_cluster issue? What else could be going  
on? This seems really weird, but also probably something really simple  
and I’m just blind.

Thanks in advance for any pointers!

---

<div class="post-metadata">

**Author:** ![skaufman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8e7dd6/32.png) [@skaufman](https://www.ruby-forum.com/u/skaufman)\
**Post date:** [November 25, 2008, 2:16am UTC](https://www.ruby-forum.com/t/keeping-users-logged-in-between-browser-launches/154071/2 "2008-11-25T02:16:32Z")

</div>

## Perhaps look at how the new restful\_authentication [http://github.com/technoweenie/restful\_authentication](http://github.com/technoweenie/restful_authentication) does it and see if you can understand that.

Ryan B.  
Freelancer

> **[frozenplague.net](http://frozenplague.net)**
>
> This domain may be for sale!

---

<div class="post-metadata">

**Author:** ![skaufman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8e7dd6/32.png) [@skaufman](https://www.ruby-forum.com/u/skaufman)\
**Post date:** [November 25, 2008, 6:52am UTC](https://www.ruby-forum.com/t/keeping-users-logged-in-between-browser-launches/154071/3 "2008-11-25T06:52:33Z")

</div>

The one thing that jumps out at me is you are setting the time to utc in  
the cookie. I am pretty sure rails does this for you automatically, but  
am not 100% certain. I know for my cookies I do not have to do this and  
it works fine:

cookies[:name] = {:value =\> “value”, :expires =\> 1.year.from\_now}

Lastly, you might want to check out Authlogic as it is a simple way to  
get authentication into your app:

> **[GitHub - binarylogic/authlogic: A simple ruby authentication solution.](https://github.com/binarylogic/authlogic/tree/master)**
>
> master

---

<div class="post-metadata">

**Author:** ![skaufman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8e7dd6/32.png) [@skaufman](https://www.ruby-forum.com/u/skaufman)\
**Post date:** [November 25, 2008, 7:45pm UTC](https://www.ruby-forum.com/t/keeping-users-logged-in-between-browser-launches/154071/4 "2008-11-25T19:45:46Z")

</div>

Thanks for the suggestions! Clearly restful\_authentication and  
authlogic have moved the ball far downfield from where Beast was  
playing back in the day.

It’s looking as if this might be more of a browser issue, though. My  
sites (and [http://beast.caboo.se/](http://beast.caboo.se/) for that matter) DO retain logins  
between browser restarts sometimes. So it’s hard to imagine that this  
is a server-side matter…