Question

Correct me if I’m wrong please:

• Sessions will last a finite amount of time (refreshed from the server every 15 or so minutes until the browser is closed) – more secure/short term
• Cookies on the other hand can last until the browser closes or to some specific time in the future – least secure/long term

Given this, how do allow a user to close his/her computer, come back a few days later and open a site and still be logged in using cookies and still somehow being secure?

How does someone like, amazon for instance do this?

EDIT:

To be more clear, here is an example:

if (!isset($_SESSION['id'])) 
{   
    $_SESSION['id'] = $_COOKIE['id'];
    $_SESSION['email'] = $_COOKIE['email'];
}

this is obviously bad, what is a better way?

Answer 1

For the cookies I use the method described here:
http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice/
and here: http://jaspan.com/improved_persistent_login_cookie_best_practice