How to implement remember me feature? [duplicate]

Answer 1

Say database table's name for persistent cookie is pcookies with the following columns:

• cookie_id (CHAR)
• user_id (INT)
• expiry (DATETIME)
• salt (CHAR)

Cookie creation steps:

1. After successful login, create a cookie record in database under an unique id. You may generate it by hash_hmac('sha512', $token, $salt) where $token=uniqid($user_id, TRUE) and $salt=md5(mt_rand()).
2. Store 'user id', 'expiration time' and 'salt' along with the 'cookie id' in database.
3. Store 'cookie id' and 'token' in cookie.

Authentication steps:

1. If there is a persistent cookie found, first check whether the record is available in database or not.
2. If the record is available then check whether the cookie expires or not.
3. If the cookie does not expire, then validate the cookie id by $cookie_id == hash_hmac('sha512',$token_from_cookie,$salt_from_db).
4. Once the cookie is validated, delete it from database and create a new cookie according to the above cookie creation steps.
5. If the cookie is found as invalid, then clear the cookie from the device and delete all other cookie records of the user from database, notice the use about a theft attempt and proceed to manual login process.

Notes:

• When session is available, ignore checking cookie.
• After logout, clear the cookie along with the database record.
• Never allow users to execute sensitive requests like password change or view credit card information from a persistent cookie login. Invoke password to login and add a flag in the session to allow all onward operations.

Answer 2

These two posts provide excellent implementation guidelines for persistent login cookies:

• http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/
• http://jaspan.com/improved_persistent_login_cookie_best_practice

(Read them in the given order, since the second one improves the first one.)