如何使用cookie自动重新登录用户

Question

So on my application login form I've got one of those little boxes like [_]remember me

When the user checks that we set $_COOKIE['rememberMe'] with the value of the username. Now when that user comes back 3 days later, I obviously want to recognize them and re-log them in automatically. It doesn't sound safe to simply check for the existence of that cookie and then use it's value as the username to login without a password. But I'm not sure how else I would log them automatically... Is there a way this usually done?

Answer 1

Your cookie should have three values: 1. username 2. expiration time 3. a session code

When a user logs in, generate a session code and set an expiration time. Store that session code and expiration time in the cookie and on your database.

Then whenever user returns to the site, and if user is not logged in: 1. check for the cookie 2. check for the cookie against the database

If all three variable matches and the expiration time is not over, log the user in.

Alternatively, if you simply encode the session code as say a md5 of ($username.$expiration_time), then you won't have to set up a database for storing and checking. Although having a database with randomly generated session code is much safer.