Question

I have implemented a login class in PHP, and want to create a remember me type functionality so users won’t have to login with each visit. I have researched this a bit and was preparing to write it using PHP setcookie(…) but then ran across this page: How to Create 'Remember Me' using jquery , store cookies. I was planning on writing this in PHP since it’s my strength, but this page makes it look so easy in js: http://www.quirksmode.org/js/cookies.html

I am looking for a little guidance on gotchas for each method, and more specifically issues related to security. I just want to make sure I don’t complicate the task or open any holes by providing this type of functionality.

Thanks, Kris

Answer 1

It doesn’t make much sense to create an identification token on the server, send it to the client and set there using Javascript compared to setting it at server-side in the first place.

More importantly, using Javascript makes it compatible with less clients, less robust, and less secure (as you cannot use HTTPOnly cookies).