how do securely store username and password in cookies ?

[jasonc]

I have had a load of people who are silly enought to forget their username and or password so wish to add in the option for them to save their details in a cookie, and break my number one rule, never to use them!!!

 

can anyone suggest how i can do this so it is stored safely like most websites do it.

[raknjak]

You are in luck, I just picked this off their newsletter and then came here

 

http://thinkvitamin.com/code/how-to-create-totally-secure-cookies/

 

Awesome site and I highly recommend anyone to subscribe to their feed.

[ManiacDan]

Never store username and password in a cookie.  If you must use a "remember me" cookie, do that, but don't actually store their password on their machine.

 

Also, sessions rely on cookies, so you've been breaking your rule all along.

 

-Dan

[cyberRobot]

I agree with Dan; it's best not to store login info inside the cookie. You'll be better off storing their table row ID for example. But keep in mind that cookies are very easy to edit if the user knows how. So it would be easy for them to change the ID to whatever they want.

 

So you'll want to dynamically create some other key to help prevent tampering with the cookie.

[ManiacDan]

Auto-login cookies are generally created using a hash of four things:

1)  Something they know that you don't know (password)

2)  Something you know that they don't know (auto-generated hash stored in their user table, the microtime of their signup time, etc)

3)  Something unique to their machine (IP)

4)  A fixed salt that no user knows.

 

Hash all those things, and store them in the DB along with their username or UserID.  When they come back to the site, load the data for their user, and compare the generated hash on the server with the hash stored on their machine.  If it matches, log them in.  If it doesn't match, kill the cookie and kick them to the login page.

 

-Dan