I’ve got an existing site I’m taking over, and right now it stores, in a session variable, the id of the currently logged in user (if logged in at all — otherwise I’m sure it is empty string or null or something).
The client now wants, after someone is logged in, to ‘keep’ them logged in on that computer for an indefinite amount of time.
ASP.net Sessions have a maximum idle time of 1 day, I believe. The website isn’t written all that well in the Flash portion (whole front end is flash) and the flash will process a login, then, as long as the flash isn’t reloaded, assume that the user is still ‘logged in’.
I think my solution is to ALSO store a client side cookie with some GUID value and hold in the database the associated user id…sort of like a session that never expires. So, when the page is loaded, I can check my cookie, use that to select the userid out of the database, and if we find one, then set the session value that says user 23 is logged in.
Does anyone see any issues with this perspective? Would you recommend something different? I really don’t want to refactor a bunch of the existing code, but just slip this in on top…
PS — security is not really a concern. The only reason they have people log in is so we can track orders by a person, but no money changes hands through this website. There is also no personal information that a user can view or edit, either.
This is how I do it. I actually have a cookie that holds their login and password, this way I can automatically log them in should they not be logged in. I expire the cookie after a couple of days of inactivity. The downside is that everyone forgets their password because the only time they really have to enter their password is when they come back from extended time-off.
This is for an internal application, with the same customer demands that you have and this works … and makes the customer happy.
One thing we may end up doing is just using Windows authenication, might actually work better in this circumstance.