I'm following solution #1 of this answer. After a while, there will be some redundant rows in the table. Suppose this table:

// cookies
|   id    |         email           |     cookie       | date_time  |   device   |
| int(11) |      varchar(50)        |   varchar(128)   |  int(11)   |            |
| 1       | jack_2009@gmail.com     | ojer0f934mf2...  | 1467204523 |            |
| 2       | peter.zm@yahoo.com      | ko4398f43043...  | 1467205521 |            |
| 3       | matrix_john23@gmail.com | 34fjkg3j438t...  | 1467205601 |            |
| 4       | peter.zm@yahoo.com      | 0243hfd348i4...  | 1467206039 |            |

So the email column isn't unique and each device has its own row.

My question: How can I fill the device column? Do I even need to detect the user's device or should I handle it another way?

Why do I need to determine devices? Since when a user removes their browser's cookies, then my website identifies them as a new user and creates a new row for them into table above. So after a while, there will be some redundant rows in the table.

For example: Imagine peter has only two devices (laptop, phone). And he has two rows in the table above. He removes his browser's cookies and logs in. What happens? My website creates a new row into table above. Now peter has 3 rows in the table above (while he has just two devices). So surely one of those three rows is redundant. That's why I need to detect devices to remove redundant rows.

  • Here's Troy Hunt on remember me: troyhunt.com/how-to-build-and-how-not-to-build – Anders Jun 29 '16 at 15:12
  • @stack, exactly what functionality do you want from "remember me"? Don't you need to store which session has the "remember me" flag set? – Jedi Jun 29 '16 at 15:41
  • @Jedi All I want from "remember me" is log in once (not every time). – stack Jun 29 '16 at 15:59
  • @stack, once every (day/week/lifetime)? And everyone else logs in every time they (close the browser/visit a page after more than x hours/....)? – Jedi Jun 29 '16 at 16:05
  • @Jedi once until log out. – stack Jun 29 '16 at 16:45

You can not reliably detect devices, and nor do you need to. Just use the timestamp to routinely delete sessions that are more than X hours old. Note it's perfectly fine to have redundant data in a working table such as this, which was your original concern.

You will need to do that anyway since sessions should always be terminated server side as well as client side. This is important to mitigate the effects of session theaft.

If X gets very large, or is infinite (the user is never logged out) this could become a problem. I would however recommend you to set a time limit even if the user do check "Remember me". I think WordPress uses 14 days, and Facebook 1 year.

But I would really, really recommend you to use an existing framework for this and not roll your own (if your are working on something that should be used in production). If you make just one mistake in your authentication scheme you could open up your whole web app to all of the world. In situations like that, it is better to stick to the tried and true.

  • When a user clicks on the "remember me on this device" flag, I think OP wishes to remove the session timeout altogether. Now, unless the user clicks on "logout", this session will persist in the backend; even if the user deletes cookies. The only mitigation would be identifying a duplicate login from the same device and terminating the first session server-side (or setting some kind of expiry/inactivity). Agree with your recommendation -- don't roll your own, use a reliable framework. – Jedi Jun 29 '16 at 15:04
  • @Jedi Good point. I have added a paragraph to my answer to adress this. – Anders Jun 29 '16 at 15:11
  • I cannot use an existing framework, that's my university's project and I have to create my own system. – stack Jun 29 '16 at 16:00
  • @stack Ah. Developing your own solution is a good way to learn, so best of luck with the project! – Anders Jun 29 '16 at 16:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.