I'm using a public device vs Keep me signed in

Question

I know this might be an obvious question, but its escaping me. When logging on websites, I have seen check boxes for things like "i'm using a public device" and "Keep me signed in".

I know keep me signed in would be the traditional login function which would be meant to keep the user always logged in. But I'm stuck on the "I'm using a public device" feature, what does it actually to do? Does it just limit the length of the login period?

I don't use session logins, I use a tokenized cookie with 24 hour expiration that is matched up in a database table to the user and subsequently their shopping cart.

Answer 1

It means that you should remove/destroy all traces of the person when they log out or the browser (or tab) is closed (if possible). You don't want the next person to sit down at the computer to have hint of what the last person was doing or see anything that belongs to them.

Answer 2

To remember your logged in state a site needs to send some data to the browser that the browser then sends back on the next request to show they are logged in. This data is usually stored in a cookie.

If you select "remember me" the cookie will be set to expire some time in the future, so if you return within that time you'll be remembered, otherwise it's likely to be set for a much shorter time but usually on the order of a few minutes to hours so that you're still logged in if you wander off, but return after making a cup of tea.

If you select "I'm using a public device" the lifespan of the cookie will be much smaller, or set as a "Session" cookie, which the browser will remove when you've closed all tabs with that site or navigated away.