I'm making a website that has an extended forum feature, where users can login, post comments, etc. I'm making the feature where the website stores cookies in your computer so the next time you visit the website, it logs you in automatically.
I've heard not to store explicit username and password in a cookie. So I decided to store the user id in my database as a cookie value. Essentially, all information when you use the site can be obtained by querying the database again by this user ID.
Then I just realized that if you manually edit your cookie and place a random user ID, anyone would be able to access any account! All the functions in the website such as new comment, new topic etc. are can be accessed just by supplying your user ID.
What is the correct way to have users log in automatically on my site without exposing it so anyone can log in?