Think: How do I use the remember_me cookie after a user logs out?

Question

I am working on a Rails 4.2 application and use devise gem for authentication.

For the remember_me function, devise generates a remember_user_token cookie, which is destroyed after sign_out .

Is there a way that devise should not destroy remember_user_token ?

I tried false below config in initializer

config.expire_all_remember_me_on_sign_out = false

But it did not help.

I need this cookie after logging out so that it fills out the login form.

Please, help.

thanks

Answer 1

Checking the link with pre-filling out the form is not necessarily a good idea. You can save the login in cookie upon successful login. You can override the create method in SessionsController , call super to call Devise::SessionsController#create and pass a block to it. The block will be executed after a successful login and will receive the user as a parameter.

 class SessionsController < Devise::SessionsController def create super do |user| cookies[:login] = user.login end end end 

Answer 2

Here is the bottom level in the cookie store. First of all, everything in a cookie exists permanently after its installation or until the user manually deletes the cookie. This means that if you set user_id and user_group_id, then there is in good condition in the cookie before updating or deleting. This is different from a session because the session is similar to ram on a computer, as soon as the browser is closed, the session is closed with it, as well as all its data.

• So, this means that when you log out of your user, you need to indicate that their cookie empties everything that you do not need. When your user logs in, you install everything that you want the user to have during login. Thus, since the session and the cookie are completely separate, they never interact with each other unless you want to make them. This way, your session will never upload itself to the cookie store unless you do so.

• Each time your users go to your site, you can have one handshake that ensures that the cookie matches db if necessary. Otherwise, you may have different data that is updated only when you log in, and what is not without a handshake, the user will need to log in to make sure that they are still valid, which defeats the goal of having a cookie in the first place .

• The disadvantage of client-side cookie storage is a security issue. Depending on how you use the cookie to store data, a person may grab some cookies on your site and pretend they are. This can be avoided by careful design, but just assume that everything in your cookie store is an honest game for everyone, so use it carefully and only for unclassified data.

Hope this helps!