Is cookie based authentication secure?
It’s very secure. Session ID is simply a random number. You don’t have to worry about compromised key or salt. The cookie can be easily revoked from server.
How does the Remember Me feature work?
Clicking the “Remember Me” box tells the browser to save a cookie so that if you close out the window for the site without signing out, the next time you go back, you will be signed back in automatically. Make sure that you have your browser set to remember cookies, or this function will not work.
How do I find my Remember me?
When you check the “Remember Me” checkbox at the Portal Login page, your login will be remembered for some days, even after you close your browser. The next time you open the same browser within that time period, you will be automatically logged in.
Why are the cookies not set on Remember Me?
Let’s take a look at the cookies: This is a fairly impressive set of cookies but it’s the highlighted ones that are genuinely interesting. These cookies won’t get set if you don’t check the “remember me” box so their function is purely to log you back in later on.
How to securely implement a ” Remember Me ” feature?
Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let’s say 30 days)?
What do you need to know about Remember Me?
When the user successfully logs in with Remember Me checked, a login cookie is issued in addition to the standard session management cookie. The login cookie contains a series identifier and a token. The series and token are unguessable random numbers from a suitably large space.
What’s the difference between session cookie and Rememberance Cookie?
This should be a “rememberance” cookie only, NOT a session cookie – i.e. when you get that cookie without a session, reissue a new, regular session cookie. Also note that like the session cookie, this should be delivered only over https, and using the secure and httpOnly attributes, and of course have the cookie scoped properly etc.