Timeline for How to Securely Implement a "Remember Me" Feature?
Current License: CC BY-SA 4.0
12 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Nov 22, 2019 at 8:01 | history | edited | AviD♦ | CC BY-SA 4.0 |
Referred to Scott's answer
|
| Jan 18, 2016 at 23:39 | comment | added | AviD♦ | My answer is incomplete and has a nontrivial flaw, in some situations - please see @Scott's answer, security.stackexchange.com/a/109439/33 . | |
| Dec 2, 2012 at 20:53 | comment | added | Jacco | I think we both have a different approach. data such as computer name can be spoofed, IP addresses can change for many reasons. I create a 256bit random number, store the (hash of) this number in the database and set a cookie with the primary key & random number. Whomever presents the cookie is assumed to be the user associated with the DB record. (also see the answer I linked above). | |
| Nov 30, 2012 at 13:39 | comment | added | AviD♦ | Ah, now I understand - but that's wrong, the nonce is not a password equivalent, it needs to be hashed together with user details. Otherwise you would need to store IP, computer name, etc on the server. | |
| Nov 30, 2012 at 13:23 | comment | added | Jacco | I meant to say that, because the nonce is a password equivalent, instead of the nonce, only the hash of the nonce should be stored in the database. Offcourse you also need to store things like expiration date and/or userId, etc. | |
| Nov 30, 2012 at 0:54 | comment | added | AviD♦ | @Jacco you need to store the expiry date, so you know till when it is valid. Assuming you want it to expire after a limited time... | |
| Nov 30, 2012 at 0:44 | comment | added | Jacco | Only the hash of the nonce should be stored in the database. | |
| Dec 11, 2010 at 16:37 | vote | accept | colithium | ||
| Nov 19, 2010 at 12:11 | comment | added | AviD♦ | @adamse, nice, I usually refer to LinkedIn. Amazon even better :) | |
| Nov 19, 2010 at 11:54 | comment | added | ase | See Amazon for an example of the second part! | |
| Nov 17, 2010 at 6:11 | history | edited | AviD♦ | CC BY-SA 2.5 |
added 211 characters in body
|
| Nov 11, 2010 at 22:56 | history | answered | AviD♦ | CC BY-SA 2.5 |