3 added 210 characters in body
source | link

The usualOne way is:

  • When the user logs in, store a session ID in a cookie on the client's computer (not the username or password).
  • Tie session to IP address, so an individual session ID only works with the computer it was started on.

Depending on what framework you are using to develop your site, this behavior may be available as a built-in feature.

Note that, because the HTTP protocol is stateless anyway, there is actually no functional difference between keeping someone logged in during a single session of using the website and "auto-login" the next time they use the site; it is solely a matter of how much time you allow before the session expires.

Update: Also, consider usinguse HTTPS for increased security, obviously.

Update 2: Note that this approach has limitations, in that it doesn't work well for users who change their IP address a lot. However, it does provide an increased level of security and may be useful in some situations.

The usual way is:

  • When the user logs in, store a session ID in a cookie on the client's computer (not the username or password).
  • Tie session to IP address, so an individual session ID only works with the computer it was started on.

Depending on what framework you are using to develop your site, this behavior may be available as a built-in feature.

Note that, because the HTTP protocol is stateless anyway, there is actually no functional difference between keeping someone logged in during a single session of using the website and "auto-login" the next time they use the site; it is solely a matter of how much time you allow before the session expires.

Update: Also, consider using HTTPS for increased security, obviously.

One way is:

  • When the user logs in, store a session ID in a cookie on the client's computer (not the username or password).
  • Tie session to IP address, so an individual session ID only works with the computer it was started on.

Depending on what framework you are using to develop your site, this behavior may be available as a built-in feature.

Note that, because the HTTP protocol is stateless anyway, there is actually no functional difference between keeping someone logged in during a single session of using the website and "auto-login" the next time they use the site; it is solely a matter of how much time you allow before the session expires.

Update: Also, use HTTPS for increased security, obviously.

Update 2: Note that this approach has limitations, in that it doesn't work well for users who change their IP address a lot. However, it does provide an increased level of security and may be useful in some situations.

2 added 79 characters in body
source | link

The usual way is:

  • When the user logs in, store a session ID in a cookie on the client's computer (not the username or password).
  • Tie session to IP address, so an individual session ID only works with the computer it was started on.

Depending on what framework you are using to develop your site, this behavior may be available as a built-in feature.

Note that, because the HTTP protocol is stateless anyway, there is actually no functional difference between keeping someone logged in during a single session of using the website and "auto-login" the next time they use the site; it is solely a matter of how much time you allow before the session expires.

Update: Also, consider using HTTPS for increased security, obviously.

The usual way is:

  • When the user logs in, store a session ID in a cookie on the client's computer (not the username or password).
  • Tie session to IP address, so an individual session ID only works with the computer it was started on.

Depending on what framework you are using to develop your site, this behavior may be available as a built-in feature.

Note that, because the HTTP protocol is stateless anyway, there is actually no functional difference between keeping someone logged in during a single session of using the website and "auto-login" the next time they use the site; it is solely a matter of how much time you allow before the session expires.

The usual way is:

  • When the user logs in, store a session ID in a cookie on the client's computer (not the username or password).
  • Tie session to IP address, so an individual session ID only works with the computer it was started on.

Depending on what framework you are using to develop your site, this behavior may be available as a built-in feature.

Note that, because the HTTP protocol is stateless anyway, there is actually no functional difference between keeping someone logged in during a single session of using the website and "auto-login" the next time they use the site; it is solely a matter of how much time you allow before the session expires.

Update: Also, consider using HTTPS for increased security, obviously.

1
source | link

The usual way is:

  • When the user logs in, store a session ID in a cookie on the client's computer (not the username or password).
  • Tie session to IP address, so an individual session ID only works with the computer it was started on.

Depending on what framework you are using to develop your site, this behavior may be available as a built-in feature.

Note that, because the HTTP protocol is stateless anyway, there is actually no functional difference between keeping someone logged in during a single session of using the website and "auto-login" the next time they use the site; it is solely a matter of how much time you allow before the session expires.