longest lasting cookie

Question

I want to keep a user logged in as long as possible. What should I use?

• regular cookie
• persistent cookie
• flash cookie
• ip address
• session

or some combination of these?

Answer 1

I think a Flash cookie would probably stay around the longest for the simple reason that most people don't clear them too often. They don't show up in the usual browser dialogs and aren't cleared by the usual "clear cookies" feature.

Trying to tie a user to an IP address is useless and downright insecure if you're trying to keep people logged in. IP addresses change often and you shouldn't rely on it for anything serious.

I guess the best thing to do is use both a normal browser cookie and a Flash cookie. That way you catch all the Flash-less users (or those who block Flash by default) just in case.