What is the most secure way to do a cookie based "Stay logged in"?

Question

what is the securest way to do a "stay logged in" feature?

i think thinking of user logs in store their userid, timestamp and a hash of timestamp + salt + hash of their pw in a cookie. then when they visit the site next, check if a hash of the cookie timestamp + salt + hash of their pw is valid

(ie... (untested, and ignore lack of mysql_real_escape_string())

(this is in php)

 /*
 cookie contains these fields:
 username
 timestamp
 hash
 */

 $row  = mysql_fetch_array($result); 
            ## sql would be something like select salt,
            ## username from users where user = $_COOKIE['username']

 $generated_cookie_data = my_hash_func(
            $_COOKIE['timestamp'] . 
            $row['salt_from_db'] .
             my_hash_func([$row['password'])
             )

 if ($generated_cookie_data == $_COOKIE['hash']) {
 #logged in!
 }
 else {
 #not logged in!
 }

Although this most definitely belongs on StackOverflow, a question like this probably has been asked many times before. After all, cookie-based user authentication is a common issue. — Josh Hunt, Nov 11 '09 at 14:00
Please see: http://stackoverflow.com/questions/1221447/what-do-i-need-to-store-in-the-php-session-when-user-logged-in/1225668#1225668 — Andrew Moore, Nov 11 '09 at 14:19
possible duplicate of ["Keep Me Logged In" - the best approach](http://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach) — kapa, Jun 02 '11 at 14:19

BalusC · Answer 1 · 2009-11-11T18:59:57.597

1

Just generate a long, pure random and unique ID. Don't matter how, there is absolutely no need to base it on salt+password+IP, it only absolutely must not have a pattern (i.e. don't use IP, timestamp, etc). Have a database table user_session with the columns session_id (PK) and user_id (FK) (and if necessary more, like session_ttl, user_ip and so on). Generate a session ID and check if it exist in the table. If not, then save it along with the user ID in the table. Store the very same session ID in a long living cookie and check it on every new request.

edited Nov 11 '09 at 18:59

answered Nov 11 '09 at 15:21

BalusC

1,082,665
372
3,610
3,555

2

if you include the password in the hash then it will be automatically invalidated by a user changing their password, which is a good thing – Greg Nov 11 '09 at 20:09

score 1 · Answer 2 · answered Nov 11 '09 at 16:29

1

Most likely you should not do this yourself - reinventing the wheel will get you a bad wheel. Use whatever session management your web programming frameworks provide. What, you're not using a framework? Then you're mad, and I wish you luck.

answered Nov 11 '09 at 16:29

Teddy

6,013
3
26
38

score 0 · Answer 3 · answered Nov 11 '09 at 15:10

I think you should include the IP address in the hash. That way, if another user somehow stole the cookie, they wouldn't have access to the session.

A more secure method would be to generate a random ID each time the user logs in and store that in the user table. Then hash random + salt + password + ip.

score 0 · Answer 4 · answered Nov 11 '09 at 15:17

IMO you should never reveal information about the users password (even a hash). If someone got access to this hash they can try as many times as they like at guessing the users password. They are not limited by any security mechanisms you have to protect accounts from random guessing.

If I were using the approach you describe I would at least create a random number that is stored in he db instead of using the password.

What is the most secure way to do a cookie based "Stay logged in"?

4 Answers4