How to implement remember me feature? [duplicate]

Question

Possible Duplicate:
What is the best way to implement “remember me” for a website?

Every user has unique 32 chars id (made of like this: md5("salt" . $username . $user_password . "salt2");). And I store this value under 'unique_id' field in table users. Is it a good way to assign this value to user's cookie and let him be logged in only if he has it assigned? And of course check it if that value exists in database?

I don't think it's a a good practise, because if someone steals your cookie, they will be able to log in to your account.

What's the other/better solution? Of course the safest thing is probably just to store it in sessions, but I want to implement this remember me feature.

Thanks.

Answer 1

Say database table's name for persistent cookie is pcookies with the following columns:

• cookie_id (CHAR)
• user_id (INT)
• expiry (DATETIME)
• salt (CHAR)

Cookie creation steps:

1. After successful login, create a cookie record in database under an unique id. You may generate it by hash_hmac('sha512', $token, $salt) where $token=uniqid($user_id, TRUE) and $salt=md5(mt_rand()).
2. Store 'user id', 'expiration time' and 'salt' along with the 'cookie id' in database.
3. Store 'cookie id' and 'token' in cookie.

Authentication steps:

1. If there is a persistent cookie found, first check whether the record is available in database or not.
2. If the record is available then check whether the cookie expires or not.
3. If the cookie does not expire, then validate the cookie id by $cookie_id == hash_hmac('sha512',$token_from_cookie,$salt_from_db).
4. Once the cookie is validated, delete it from database and create a new cookie according to the above cookie creation steps.
5. If the cookie is found as invalid, then clear the cookie from the device and delete all other cookie records of the user from database, notice the use about a theft attempt and proceed to manual login process.

Notes:

• When session is available, ignore checking cookie.
• After logout, clear the cookie along with the database record.
• Never allow users to execute sensitive requests like password change or view credit card information from a persistent cookie login. Invoke password to login and add a flag in the session to allow all onward operations.

Answer 2

These two posts provide excellent implementation guidelines for persistent login cookies:

• http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/
• http://jaspan.com/improved_persistent_login_cookie_best_practice

(Read them in the given order, since the second one improves the first one.)