I have a website which have a "remember me" functionality. When someone clicks that functionality it sets the user password and username in a cookie to remember him/her. Okay, fine.
But, that cookie is a HTTPonly cookie (no worry for XSS) with the Secure flag set. Is it enough security in there?
document.cookie). So my opinion is that this implementation is secure enough. But I am curious to know of yours.