Assuming you already have a website that implements all of the standard login stuff, what is the correct and most secure way to allow users to automatically be logged in for a certain time period (let's say 30 days)? This time period should be strictly enforced; ie, I don't think a valid solution would be giving a cookie an expiration date and hoping the user's browser deletes it in a timely manner.
Details of the existing login system:
- A user must enter a user name and password
- The database stores usernames as well as strong_hash_function(password + user_specific_random_salt)
- Login forms are loaded and submitted over SSL, as are all subsequent pages
There are many examples out there and many with obvious security flaws. Let's use PHP as the target language but the concepts should be applicable to any language.
