Home/ Questions/Q 7904459
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-03T10:04:55+00:00

I am trying to implement a ‘remember me’ system with cookies that will remember

  • 0

I am trying to implement a ‘remember me’ system with cookies that will remember a user across browsers meaning that if a user logs into a website using browser A and checks ‘remember me’, and then logs into browser B using ‘remember me’, he will continue to be automatically logged in regardless of which browser he uses. (checking ‘remember me’ in browser B will not break his persistent login in browser A).

To do this, I set up my database so that multiple keys can be stored alongside a user id. When a user logs onto my website, the cookie’s value is checked. If that value is found in the database, the user is assigned a new cookie and that cookie key entry in the database is updated to match. Other keys are left alone so that other browsers’ login persistence will not be affected. When a user logs out manually, the cookie is checked, the corresponding entry in the database is deleted, and then the cookie is deleted.

The problem comes up when a user manually deletes his cookie. If the user does this, I have no way of deleting the corresponding entry in the database. It will simply become a permanent entry in my database. This was not a problem when I was not trying to support cross-browser ‘remember me’, but has become a problem by allowing multiple cookie keys to be stored.

Is there any way that I can fix / avoid this?

There is a ton of information out there on persistent logins, but persistent logins across browsers never seems to be covered, so any help would be great. (Also feel free to critique my approach and any security issues. It seemed way more secure when I was only allowing one ‘remember me’ per user, but persistent log ins across browsers seems like functionality that users would want).

I am using MySQL and PHP.

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    I agree with @llion’s suggestion of setting an expiry on the cookies, in which case you can schedule a process to clear out expired cookies from the dB. However, you can make this appear to the user almost as though the cookies are indefinitely persistent by extending their life whenever you see them.

    For the benefit of any other readers interested in this question, I really hope that you are only storing hashes of the cookie in your dB.

    • 0