0

Moved to: https://webmasters.stackexchange.com/questions/31834/remember-me-or-not

Is it safe to have the remember me feature? Would it be somewhat safe (knowing it won't be 100% safe) to allow users to close their browser and come back still logged in? I am not exacting sure which way I should go after reading different things about safety. I learned about session fixation and implemented security to add more protection.

From experience, if remember me is checked then only your username/email appears and requires you to re-enter your password. Other sites allow you to come in and out as much as you way without logging out after the browser has closed.

If it is safe, what is the current best way of implementing remember/stay logged in?

Also: The site I am working on is email & password login type.

Community
  • 1
  • 1
hieimora
  • 313
  • 1
  • 4
  • 13

1 Answers1

3

It's always safer with sessions only. But you can make cookies to be safe, however. I suggest you to make "Remember me", because it provides better user expirience.

Here's what I suggest about making a safe "Remember me" system:

  • store user's ID in cookie
  • generate special token and hash+salt and store them in cookies
  • store everything in database
  • get data from cookies on every page load and try searching for them in database
  • if not found, then logout a user
  • change token on every page load
Nikola K.
  • 7,093
  • 13
  • 31
  • 39