Devise gem: what's the difference between config.remember_for and config.timeout_in?

Question

Ideally, I would like to automatically remember my users once they login, and keep them logged in for a few weeks until asking for credentials again. Shall I then set config.remember_for = 3.weeks or config.timeout_in = 3.weeks ?

Answer 1

Those are two separate entities (even two separate modules in Devise).

First (remember_for), is to remember user for a specified amount of time (usually days or months), so that he can get into the app without going though the login procedure every time.

Second (timeout_in), is to logout user after he is idle for some time. This is the same as when you logged in to your bank account, and it would log you out after ten or twenty minutes of inactivity to protect your confidential information.

So, remember_for is the one you should choose.