Chapter 9

[nguyenthanhhaaa]

WHAT

-Remember token and digest: Added a remember_digest column to the users table and introduced logic to generate a secure token and store its digest.

-Login with remembering: Allows users to remain logged in by storing a token in cookies.

-Forgetting users: Provides a way to remove the persistent login token (forget) when users choose not to stay logged in anymore.

-“Remember me” checkbox: Added a checkbox in the login form so users can opt to be remembered on their device.

WHY

-User experience: Improves convenience by not requiring users to log in again every time they revisit the site.

-Security: Uses token + digest to avoid storing passwords in plain text within cookies.

-User preference: Some users may not want to stay logged in on public computers, hence the “Remember me” checkbox gives them control.

HOW

-Remember_digest column: Created a migration to add the remember_digest column to the users table.

-User model:

-Created a class method User.new_token to generate a random token.

-Created a class method User.digest(token) to hash the token using BCrypt.

-Added instance methods remember (stores token digest in remember_digest) and forget (clears the digest).

-Added authenticated?(token) to compare a given token with the stored digest.

-SessionsHelper:

-Added methods remember(user) and forget(user) to set/delete the appropriate cookies.

-Updated current_user to check the remember_token cookie if the session is empty.

-Login form:

-Added a :remember_me checkbox.

-In SessionsController#create, if params[:session][:remember_me] == "1", call remember(user); otherwise, call forget(user).

NOTES

-Consider extending security measures (e.g., encrypting cookies, limiting the remember duration).

-Implement model and integration tests for the remember-me feature.

-Check for potential conflicts with other authentication methods (e.g., OAuth, Single Sign-On).