Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How to automatically keep user remembered in Devise

I am building an app in which I would like the users to automatically be remembered on their computers, without having a "remember me" check box.

I read that I may have to call @user.remember_me!, but not sure where to call it since the Devise controllers are hidden.

I was considering adding a hidden checkbox field in the sign_in form with the checkbox marked by default, but I was hoping I could do this on the controllers side.

Any idea how this could be done?

Thanks!

like image 834
Karan Avatar asked Jan 19 '13 18:01

Karan


People also ask

How does devise Rememberable work?

Rememberable manages generating and clearing token for remembering the user from a saved cookie. Rememberable also has utility methods for dealing with serializing the user into the cookie and back from the cookie, trying to lookup the record based on the saved information.

What is devise authentication?

Devise is a well known solution for authentication in Rails applications. It's full featured (it not only adds authentication but also password recovery, email changing, session timeout, locking, ip tracking, etc.) and can be expanded to add even more (like JWT authentication).

How do you get a password in devise?

Devise initially stores the original password by encrypting it. The encrypted_password (field name in your model) gets stored in the database. Now, when you call User. find_by :email => "[email protected]" the password field is non existing.

What is the user_SRP_Auth remembered devices functionality?

Note: The remembered devices functionality works only with the USER_SRP_AUTH authentication flow. Also, this functionality requires multi-factor authentication (MFA) to be enabled for the user pool. Remembering devices is a two-part process: Confirming a new device.

What does remember my user name mean?

Alternative forms of this are "remember my email" or "remember user name", which makes it clear that they will need to enter their password again. This function is usually (more or less) safe on a public device; while it shows the user name, the person would need to also know the password to access a given account. Welcome back, "user name here."

How do I manage remembered devices expiry?

Remembered Devices expiry can be configured via a policy in the Duo Admin Panel to set the number of days to trust a device. Each token's timestamp is signed, meaning that any update to the setting within Duo's Admin Panel will not take hold until the existing cookie/token has expired.

How do I remember devices?

Remembering devices is a two-part process: Confirming a new device. Initiate authentication from the device, and then confirm it with Amazon Cognito to get unique device identifiers. Verifying a confirmed device.


2 Answers

If you read this pull request in devise: https://github.com/plataformatec/devise/issues/1513, the sanctioned way to remember by default appears to simply define on your User class:

class User
   def remember_me
     (super == nil) ? true : super
   end
end
like image 175
Vincent Woo Avatar answered Oct 02 '22 13:10

Vincent Woo


I think customizing your devise controller is the way to go here.

Goal: automatically set remember-me for everybody.

First, create a devise sessions controller. Let's tell rails routes about it

config/routes.rb

devise_for :users, :controllers => {:sessions => 'sessions'}

app/controllers/sessions_controller.rb

class SessionsController < Devise::SessionsController

  def create
    params[:user].merge!(remember_me: 1)
    super
  end

end

This way, the user's remember me will always be set to true. yay!

You'll then want to edit the login form to not display the remember_me checkbox.

Also, change this in the initializer to something far off:

#config.remember_for = 2.weeks
config.remember_for = 1.year
like image 32
Jesse Wolgamott Avatar answered Oct 02 '22 14:10

Jesse Wolgamott