title: Implementing a simple sign up/log in system in Rails using cookies
body: <p>I'm fairly new to Rails and I'm trying to implement a really basic user authentication system. My main problem right now is that I do not have a clue what's a good design for this.</p>
  
  <p><strong>What I have now</strong></p>
  
  <p>My Rails app is not a website; it's a webservice that communicates with an iPhone app. All communication is in JSON.</p>
  
  <p>When a user <em>signs up</em>, the app sends a POST request to <code>/users.json</code> with <code>name</code> and <code>password</code> as JSON in the HTTP body. Rails then saves the user id in a cookie:</p>
  
  <pre><code>cookies.signed[:user_id] = @user.id
  </code></pre>
  
  <p>When a user <em>logs out</em>, the app sends a POST request to <code>/logout.json</code>. Rails gets the user id from the cookie, updates the database and deletes the cookie.</p>
  
  <p>Later, when the user wants to <em>log in</em> again, the app sends a POST request to <code>/login.json</code> with <code>name</code> and <code>password</code> as JSON in the HTTP body. Rails sets the cookie again.</p>
  
  <p><strong>My question(s)</strong></p>
  
  <ol>
  <li>Is this design RESTful? Because login and logout aren't resources.</li>
  <li>Is it secure to use cookies like this? I'm planning to use SSL.</li>
  <li>Is there a better way to do this?</li>
  </ol>