rubygems/rubygems.org — pull request #678 by adammcarthur (2014-04-19 11:41:05+00:00)
Title: Allow users to remain signed in for up to a year

Hey all.

I was surprised to learn that there isn't some sort of option to remain signed in to the website. I'm sure at least some of you agree it can get really frustrating having to sign in each time you visit the site (after closing your browser, of course). From what I've read `Clearance` should keep users signed in until they log out, but it doesn't appear to be the case here - so if this feature WAS turned off intentionally can we reconsider the possibility of giving users the option to remain signed in? If there's a security issue with it then I understand.

I'm not entirely sure if I've implemented this feature in the "correct way" (feedback welcome), but from my manual testing everything seems to be working perfectly. Here's a screenshot:

![alt text](http://imgkk.com/i/oxkp.png "RubyGems.org Stay Signed In")

How it does it:

- When the user signs in with the checkbox ticked, a cookie is saved to their computer containing their unique `remember_token`. This will be effective for up to a year.
- `before_filter` a new `auto_login` method tries to sign in the user (providing a session doesn't already exist!) by attempting to match the `remember_token` saved in the cookie against the database. If it can't be found (ie - the user signed out), nothing happens.

Additionally, I thought it might now be appropriate to add a small disclaimer at the bottom of the about page notifying users that cookies are used to store data on their computers. I'll leave it up to your judgement on whether this is necessary or not.

Adam.