Home/ Questions/Q 6863107
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-27T02:44:31+00:00

When it comes to remember me cookies, there are 2 distinct approaches: Hashes The

  • 0

When it comes to remember me cookies, there are 2 distinct approaches:

Hashes
The remember me cookie stores a string that can identify the user (i.e. user ID) and a string that can prove that the identified user is the one it pretends to be – usually a hash based on the user password.

Tokens
The remember me cookie stores a random (meaningless), yet unique string that corresponds with with a record in a tokens table, that stores a user ID.

Which approach is more secure and what are its disadvantages?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You should use randomly generated tokens if possible. Of course, the downside is that you have to write some extra code to store and use them on the server side, so this might not be warranted for all web applications. But from a security standpoint, this has distinct advantages:

    1. An attacker cannot generate tokens from user IDs, but he can definitely generate hashes. This is a big problem, even if you use salt when generating hashes (and you should), your users are screwed if the salt ever gets into the wrong hands.

    2. Giving out these tokens enables your users (or your admin if need be) to “log out” certain sessions that they might want to get rid of. This is actually a cool feature to have, Google and Facebook use it for example.

    So, if you have time and budget: tokens, absolutely.

    • 0