Question

just wanted to know:

In my rails 3 app when a user logs in, i store their id in a session variable like this

session[:id] = @user.id

i noticed that when i login and then close the browser the session is destroyed. Is this wise to do or better to create a logout feature to destroy the sessions. What can go wrong if i leave it as is.

Thanks for help

Answer 1

I noticed that when I login and then
close the browser the session is
destroyed. Is this wise to do.

If this is happening then it’s good if session get expired/destroyed when user closes browser. This is what mostly done in websites.But can be hard when you are trying to providing remember me or always sign in like functionality. In this case you might not have to destroy session when browser is closed.

or create a logout feature to destroy
the sessions.

You can create a logout feature to destroy session but call this when user hits logout link.