Storing login information in Cookies

前端 未结 7 1520
不思量自难忘°
不思量自难忘° 2021-02-05 22:06

I want to save user\'s authentication information in browser cookie for persistent login. As they say, its never safe to store any secret info (such as password) in cookie, but

相关标签:
7条回答
  • 2021-02-05 22:56

    There is another option.

    For each user, upon logging in and requesting to be remembered, create a long random string.

    Store this string, along with the userId, in the cookie you give to the user.
    Store a properly salted hash of the string in your db.

    If the user presents a remember-me cookie, match the random string to the hashed verifier you have in your database (just as if it where a password).

    If it matches -> log the user in and create a new remember-me cookie for them.
    If doen't match -> request username and password.

    0 讨论(0)
提交回复
热议问题