# Session Timeout - Best Practice or Gem?

**URL:** <https://www.ruby-forum.com/t/session-timeout-best-practice-or-gem/117496>\
**Category:** Rails\
**Created:** [October 17, 2007, 12:23pm UTC](https://www.ruby-forum.com/t/session-timeout-best-practice-or-gem/117496 "2007-10-17T12:23:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![gavin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@gavin](https://www.ruby-forum.com/u/gavin)\
**Post date:** [October 17, 2007, 12:23pm UTC](https://www.ruby-forum.com/t/session-timeout-best-practice-or-gem/117496/1 "2007-10-17T12:23:54Z")

</div>

What’s the best practice for implementing session timeouts? Or is  
there a gem for this functionality? I remember seeing one several  
months ago but it appears that it’s no longer available.

Gavin

---

<div class="post-metadata">

**Author:** ![gavin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@gavin](https://www.ruby-forum.com/u/gavin)\
**Post date:** [October 17, 2007, 5:20pm UTC](https://www.ruby-forum.com/t/session-timeout-best-practice-or-gem/117496/2 "2007-10-17T17:20:27Z")

</div>

I wrote a simple cron job that just runs once a day, and expires any  
session older than a week.

In an ideal world, any session that is not used in more than N hours  
should be considered stale, and require a login. I’m not certain how  
to implement this yet.

–Michael

---

<div class="post-metadata">

**Author:** ![gavin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@gavin](https://www.ruby-forum.com/u/gavin)\
**Post date:** [October 18, 2007, 4:06am UTC](https://www.ruby-forum.com/t/session-timeout-best-practice-or-gem/117496/3 "2007-10-18T04:06:05Z")

</div>

On Wed, 2007-10-17 at 10:19 -0500, Michael G. wrote:

> I wrote a simple cron job that just runs once a day, and expires any  
> session older than a week.
> 
> In an ideal world, any session that is not used in more than N hours  
> should be considered stale, and require a login. I’m not certain how  
> to implement this yet.

* * *

MY\_RAILS\_ROOT/lib/session\_cleaner.rb

(my sessions are in Active Record)

class SessionCleaner  
def self.remove\_stale\_sessions  
CGI::Session::ActiveRecordStore::Session  
Session.destroy\_all( [‘updated\_at \< ?’, 30.minutes.ago] )  
end  
end

I have a cron script that runs every 5 minutes…

\*/5 \* \* \* \* /usr/bin/ruby MY\_RAILS\_ROOT/script/runner -e production   
SessionCleaner.remove\_stale\_sessions \> /dev/null 2\>&1

season to taste

Craig

---

<div class="post-metadata">

**Author:** ![gavin](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/g/439d5e/32.png) [@gavin](https://www.ruby-forum.com/u/gavin)\
**Post date:** [October 18, 2007, 10:04am UTC](https://www.ruby-forum.com/t/session-timeout-best-practice-or-gem/117496/4 "2007-10-18T10:04:55Z")

</div>

> What’s the best practice for implementing session timeouts?

Check out Rails’ sweepers