How to build (and how not to build) a secure “remember me” feature

Technically, the server cannot check cookie expiration dates, because they are never transmitted to the server. Only the cookie content is transmitted.

What I mean is: On the server, you receive an auth token that comes from the cookie. Do the logic whether or not that auth token is valid and may be used to re-authenticate the user on the server only and handle the entire logic for expiration on the server.

Do not rely on the fact that the cookie itself is present, because the user might have fiddled with the expiration date.

Being reminded of a username could also be helpful if you have more than one username at a given site - for instance, personal and business accounts for a bank or credit card site, per-project accounts for a contractor, etc.

Help!

Most of this discussion I understand. One point is, it all involves lots of work with browser cookies stored on the user's computer.

My approach so far is to send the user the character string version of a GUID (globally unique identifier, supposely unique in all space and time, on all computers or some such) in an HTML text box marked as "hidden" so that it doesn't show on the screen. Then I use that GUID value as a key in a key-value store where the value keeps the short term info I want on the user and their 'session'. I wrote my own little key-value store with TCP/IP, some class instance de/serialization, and two instances of a .NET collection class.

However, my understanding is that some browsers are willing to help implement the function "Remmeber me on this computer" without help of cookies. How? My guess: For the text boxes on the login in Web page, in the HTML use names for the boxes that the browser interprets as 'user name' and 'password', and then the browser stores the contents in its dedicated disk space by Web page. Right?

So, there's a 'security hole' here if the user is on a computer shared with other people!

Also, my understanding is that so far on mobile devices, the browsers do not permit cookies. True? And if so, do mobile browsers permit the function of remember me I described above?

Thanks.

In most parts of the world, users have dynamic IP's that change every time they connect to their ISP (often multiple times/day in the case of home users)

> What this means is that client script can access those cookies which means that if you can get a piece of XSS onto the site – just as you can on the Aussie Farmers site – you can steal cookies containing passwords if you can get a customer to load the XSS payload

The author is saying that, putting the password in a cookie means that, if there is an XSS vulnerability somewhere, it can be trivially used to steal usernames and passwords, since the XSS can be used to inject code on the site that can grab the values from document.cookie and append them to a hidden iframe.