# Restful\_authentication: update of users' attributes on every page load upon 'Remember me' being ena

**URL:** <https://www.ruby-forum.com/t/restful-authentication-update-of-users-attributes-on-every-page-load-upon-remember-me-being-ena/123354>\
**Category:** Rails\
**Created:** [December 17, 2007, 12:36am UTC](https://www.ruby-forum.com/t/restful-authentication-update-of-users-attributes-on-every-page-load-upon-remember-me-being-ena/123354 "2007-12-17T00:36:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![justbe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/74df32/32.png) [@justbe](https://www.ruby-forum.com/u/justbe)\
**Post date:** [December 17, 2007, 12:36am UTC](https://www.ruby-forum.com/t/restful-authentication-update-of-users-attributes-on-every-page-load-upon-remember-me-being-ena/123354/1 "2007-12-17T00:36:37Z")

</div>

Hello there,

I just noticed a kinda weird thing: if users log in with the ‘Remember  
Me’ option enabled, their records in the db get updated everytime the  
user reloads a page, because apparently restful\_authentication’s code  
updates the remember\_token\_expires\_at & remember\_token attributes for  
each page load (not only once on the actual login (from cookie).

Wouldn’t it make much more sense to set this remember\_token\_expires\_at  
and the corresponding token once only and that’s it? Or am I missing  
something?

Just wanna make sure the db doesn’t get hit (writing-wise) over and  
over again during a users’ browsing session on the site.

-J

---

<div class="post-metadata">

**Author:** ![justbe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/74df32/32.png) [@justbe](https://www.ruby-forum.com/u/justbe)\
**Post date:** [December 17, 2007, 12:57am UTC](https://www.ruby-forum.com/t/restful-authentication-update-of-users-attributes-on-every-page-load-upon-remember-me-being-ena/123354/2 "2007-12-17T00:57:06Z")

</div>

Say that a user spends 2 hours on one website doing stuff, and their  
remember token is saved only when they log in. After 2 hours they’re  
going  
to be doing something extremely critical (as all people who surf  
websites  
for 2 hours straight obviously do) and then their next action there not  
going to be logged in!

On Dec 17, 2007 10:06 AM, Joerg B. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> and the corresponding token once only and that’s it? Or am I missing  
> something?
> 
> Just wanna make sure the db doesn’t get hit (writing-wise) over and  
> over again during a users’ browsing session on the site.
> 
> -J
> 
> >

–  
Ryan B.

> **[frozenplague.net](http://www.frozenplague.net)**
>
> This domain may be for sale!

---

<div class="post-metadata">

**Author:** ![justbe](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/74df32/32.png) [@justbe](https://www.ruby-forum.com/u/justbe)\
**Post date:** [December 17, 2007, 9:52am UTC](https://www.ruby-forum.com/t/restful-authentication-update-of-users-attributes-on-every-page-load-upon-remember-me-being-ena/123354/3 "2007-12-17T09:52:37Z")

</div>

Ryan,

well the default remember\_me timeout is set to two weeks, so that  
shouldn’t happen & a user typically doesn’t idle on a website with his/  
her browser open for 2 weeks … well at least I hope so 😉

I do understand the basic idea behind it, but just wondering whether  
it is really necessary this way…

-J