I've been working on building a website for my school, but with a low budget, they didn't want to purchase an SSL license. I then turned to Google OAuth as that would at least encrypt the username and password. This works fine for a single session, but I would like to have the option to stay logged in long term.

Is there any safe way of logging the user back in after they have closed and reopened their browser window and the session has expired? I have considered the refresh tokens, however if you store a refresh token as a cookie, you can transfer that token to another browser/computer and get access to the account without ever logging in.

Is there anything I can do to make the system more secure? Or is it pointless anyways because you can always transfer the PHP session ID over to another browser and get in that way...

  • LetsEncrypt solves your free SSL problem.
    – schroeder
    Commented Sep 4, 2017 at 10:47

2 Answers 2


If you don't have the budget to acquire an SSL certificate (even if a DV one is extremely cheap), you can always turn to free CAs:

  • Let's Encrypt gives you free DV certificates available for 90 days, with free renewal (I actually use Let's Encrypt for my blog, and I set up cron job to renew the certificate every 80 days, I left 10 days as a spare margin)
  • Cloudflare also provides free certificates

Matter of the fact is, there are plenty of free SSL alternatives that come from many sources. While I do not deny that a paid SSL (In Theory) has more credibility, I would say that there is no reason not to use it, considering how easy it is to get it and it costs nothing. Unfortunately, I do not have enough experience to answer the question on Google OAuth.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .