Is this a reasonable way to implement 'remember me' functionality

前端 未结 3 1375
执念已碎
执念已碎 2020-12-31 17:49

If a user logs into the site, and says \'remember me\', we get the unique identifier for the user, encrypt this with RijndaelManaged with a keysize of 256 and place this in

3条回答
  •  野趣味
    野趣味 (楼主)
    2020-12-31 18:34

    Very similar question.

    The solution to your question is in this blog post

    "Persistent Login Cookie Best Practice," describes a relatively secure approach to implementing the familiar "Remember Me" option for web sites. In this article, I propose an improvement that retains all the benefits of that approach but also makes it possible to detect when a persistent login cookie has been stolen and used by an attacker.

    As Jacco says in the comments: for in depth info about secure authentication read The Definitive Guide To Website Authentication.

提交回复
热议问题