I am currently working on a pet project website and I want to implement the "remember me" feature for logins and wanted to know if my procedure is secure. The authentication process basically goes something like this:
- If a user want to be remembered and logs in successfully alongside his session cookie he gets a long-lasting remember-me cookie.
- The cookie contains some random data(a UUID) and the user's id.
- The UUID and a salted hash of the user's id get stored in a database.
- When the user has to be reauthenticated from such a cookie, the user id from the cookie is checked against the hash from the database corresponding to that random data.
- If they match, the user is logged in, the current id/hash pair is deleted from the database and the user gets a new one to give potential cookie thieves a narrower window. to act
- Id/hash pairs older than 3 weeks get expired as well to further prevent cookie theft.
I would like some review of my method. Is this secure? If so, could it be implemented in any other, perhaps simpler, manner?