This pattern of setting a cookie that expires 20 years in the future became so common that Rails added a special permanent method to implement it, so that we can simply write

Under the hood, using permanent causes Rails to set the expiration to 20.years. from_now automatically.   After the cookie is set, on subsequent page views we can retrieve the user with code like

Of course, cookies isn’t really a hash, since assigning to cookies actually saves a piece of text on the browser, but part of the beauty of Rails is that it lets you forget about that detail and concentrate on writing the application.

            You may be aware that storing authentication cookies on a user’s browser and transmitting them over the network exposes an application to a session hijacking attack, which involves copying the remember token and using it to sign in as the corresponding user. This attack was publicized by the Firesheep application, which showed that many high-profile sites (including Facebook and Twitter) were vulnerable. The solution is to use site-wide SSL as described in Section 7.4.4.