I am building a web platform, and it would be nice if I could keep users logged in on a semi-permanent basis as facebook / google etc do.
I am working in ASP.NET VB, and have created a basic login system (not using forms auth) whereby a user submits their username and password, it checks against the database (SQL Server 2012), if they match, the user is granted access (session("loggedin") = true) and their details are all stored as session variables to lower the amount of database calls during their site use.
What is the simplest, secure way to achieve this?