Can you use Devise :timeoutable and :rememberable at the same time?

Question

And if so, how are they different that that is possible?

And if not, why do both exist? Why not have one without the other? If you don't have :timeoutable, then the session is automatically remembered. If you don't have :rememberable, then the session automatically times out.

http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Rememberable

http://rubydoc.info/github/plataformatec/devise/master/Devise/Models/Timeoutable

Answer 1

Timeout:

• Session based, last_request_at is saved in the session and checked very time before processing a request.
• There are a bunch of stuff done during the request to set last_sign_in_at in User model (which is used to set the last_request_at session variable). Please refer trackable hook in devise, the flow is easy to track.

Remember Me:

• Cookie based, remember_user_token is stored as a cookie in the browser along with remember_me_created_at attribute in the devise model (User) in your database. remember_me? is called before each action to determine whether to continue without signing in.

Both in place:

If both timeout and rememberable is enabled in your application then rememberable overwrites the timeout flow.

Here, you can see that sign_out happens after timeout only when proxy.remember_me_is_active?(record) is not true.