The basic premise behind a "keep me logged in until I log out" feature is a cookie is stored with some identifier that is used to log the user in again when returning to the site. While these identifiers are generally quite long, isn't it conceivable that an attacker could - forging a cookie - randomly guess identifiers until he got lucky?
On a site with a very large quantity of logged in accounts one would hit eventually
My thoughts on protecting against this are a token with a very large # of possible values, combined with logging each attempt a IP address attempts to autologin with a cookie; any attempt with an invalid token would be considered an attack and that IP address locked out.
Is this overkill? Am I worrying about nothing?