3

I was told to post this on webmasters instead of stackoverflow.

Is it safe to have the remember me feature? Would it be somewhat safe (knowing it won't be 100% safe) to allow users to close their browser and come back still logged in? I am not exacting sure which way I should go after reading different things about safety. I learned about session fixation and implemented security to add more protection.

From experience, if remember me is checked then only your username/email appears and requires you to re-enter your password. Other sites allow you to come in and out as much as you way without logging out after the browser has closed.

If it is safe, what is the current best way of implementing remember/stay logged in?

Also: The site I am working on is email & password login type.

Improve this question
1
  • I think it's safe - be sure to notify your audience what that means, multiple users in the same computer etc., of course if it's a highly-delicate data website (like for handling money, purchases, or other delicate information) you might want to avoid that option and keep sessions to the current time.
    – casraf
    Jul 8, 2012 at 20:24

2 Answers 2

Reset to default
2

It is as safe as it seems. If you allow them to stay logged in even after rebooting the browser, then someone can get on the computer after your user and still access everything your user can access. If you are worried about someone using your site inappropriately, then you need to make a lot of adjustments on your end, even with registered users to make it "safe". If you are worried about the users information being compromised (like a little brother getting on Facebook and writing a bunch of stupid stuff) then you need to consider that too. Considering the fact that you should always protect YOUR site from EVERYONE (even registered users) I will assume for the rest of this answer you are thinking about "safe" for the user.

You need to come up with a plan that best suits your users needs. Wikipedia allows you to stay in for 180 days. Some sites never log you out. My bank logs out me after 15 minutes, and my school punts me after 10 minutes EVEN IF I AM WRITING EMAIL!! (so irritating...) You can design it so that the user can chose from a few options too: stay fully logged in forever; stay logged in for a week/day/session; Keep the username handy but require a password.

There are a lot of options, but you need to find your balance between "safe" and obnoxious...

Improve this answer
2
  • Thanks for the advice. Hopefully I figure out the balance.
    – taeja87
    Jul 9, 2012 at 13:06
  • 1
    write your email subject in a text editor, then copy and paste into email while online with your school... of course, you have graduated by now, but this might help someone else
    – elbrant
    Jul 1, 2019 at 14:38
1

If you allow the "remember me" feature to permit users to be automatically logged in again on their return then you can restrict the access rights of an "auto-logged in" user until they select a 'high risk' option (such as change password / profile information) at which point you prompt for a password to make them a "fully-logged in" user once again.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.