title: rails storing password in a session
body: <p>I have a rails app that makes web api call , the rails app by itself doesn't have any database or userstore. Every api call needs to be sent username and password for each request.</p>
  
  <p>I would like to provide an authentication mechanism for the rails app.
  I am planning to do it this way :</p>
  
  <ol>
  <li>Show a login page </li>
  <li>Get the username and password</li>
  <li>Store the username and password</li>
  <li>Perform a manual authentication either via warden.authenticate or authlogic.something ( or may be even that is not required can just check if session has something stored )</li>
  <li>And then when user does something I pass the username and password that was stored earlier.</li>
  </ol>
  
  <p>Now my problem is where do I store the password ?
  If I use session I cannot use cookie store obviously , I can use <code>session_store = :active_record_store</code> but not sure if its safe , also I don't have any database as of now so why should I create one just for session ?
  Is there any other mechanism to store passwords within a session ? (safe way obviously )</p>
  
  <p>Earlier rails had :</p>
  
  <ul>
  <li>MemoryStore</li>
  <li>FileStore</li>
  </ul>
  
  <p>But now both seems to be removed. So any other solution ?</p>
  
  <p>Notes from answers :</p>
  
  <ol>
  <li>Storing encrypted passwords won't work since I need the raw password to be sent to server while making api calls.</li>
  <li>I have no control over the API , so I cannot change its authentication.</li>
  <li>There is no user profile maintenance on rails app. Everything managed by API calls.</li>
  </ol>
  
  <p>I finally thought to implement custom memory store but it seems to throw stackoverflow error. I got the code from <a href="https://rails.lighthouseapp.com/projects/8994/tickets/1876-uninitialized-constant-actioncontrollersessionmemorystore">https://rails.lighthouseapp.com/projects/8994/tickets/1876-uninitialized-constant-actioncontrollersessionmemorystore</a></p>
  
  <pre><code>require 'action_dispatch'
  module ActionDispatch
  module Session
  class CustomMemoryStore &lt; ActionDispatch::Session::AbstractStore
    GLOBAL_HASH_TABLE = {} #:nodoc:
  
    private
      def get_session(env, sid)
        sid ||= generate_sid
        session = GLOBAL_HASH_TABLE[sid] || {}
        session = AbstractStore::SessionHash.new(self, env).merge(session)
        [sid, session]
      end
  
      def set_session(env, sid, session_data)
        GLOBAL_HASH_TABLE[sid] = session_data
        return true
      end
    end
   end
  end
  Steptools3::Application.config.session_store :custom_memory_store, :key =&gt; '_some_xyz'
  </code></pre>