Question

When a user selects the remember me function, I save his username and id in a cookie. Then, when the user returns to the site, I check the username and id against a database to ensure that the user is legitimate. I next log the user in by storing the cookie data in the session variable. Is this the proper way to remember and log in a user?

Answer 1

Cookies are not a very secure way of storing data. The cookies can be modified by a user and could lead to someone “hacking” into your site. What I would suggest is store a string in the cookie that is some hash of something. Also store the hashed string from the cookie in your database. This way when a user returns to the site, you check to see if the cookie is filled, match it to the hashed value in the database and then find who owns that hashed value. If all is valid, log them in.

Database setup

secretKey PK varchar
userid (could be unique) int
validUntil int or date/time
  //If userID is unique you will have to remove this row from the 
  // database when a new key is made for the user,  This would then mean
  // that a user would only be allowed to be rememberd on one computer

pseudocode

//User logs in with remember me
    //set cookie to something like md5(userid,username,timestamp)
    //store the md5 in the database layout
//User Returns to site
    //check to see if cookie is set
        //if cookie set
            //find md5 in database which is logged with user id
            //if found and not yet expired log in
            //else show login page
        //if cookie not set show login page

In the valid until field you would set it to say 2 weeks from login. once the valid until has passed, do not let that key work and make sure the cookie is expired for the user.

query to check login

SELECT * FROM rememberMe WHERE key=”//put md5 here” AND validUntil > time()