6

I realized that in Rails there is a built in permanent method for its persistent login cookies (aka. "remember me" cookies) method to give the client a cookie that expires in 20 years:

cookies.permanent[:remember_token] = remember_token

However it seems that in a lot of websites the cookies are set to expire in a far shorter time period, say 3 months or 2 weeks, after which the client will have to log in again.

Is it really a markedly bad practice to set a persistent login cookie to be stored permanently? Why or why not? If it's bad, why does it seem that a considerable number of developers are doing so, such that Rails has provided a built-in method to support the practice.

2

2 Answers 2

6

Remember me cookies are a special kind of cookie because they allow the user to bypass providing the authentication information, while other cookies may just track what pages you have been on or what is in your shopping cart as a non logged in (unauthenticated) user and aren't really risky except to the extent that such information is assumed to be private.

First I would say that all platforms have things that are not best practices, and they have them for all kinds of reason (backward compatibility, inertia, etc) Everyone is also much more aware of a variety of attack vectors than they were in the past. In the case of remember me cookies because you are storing information that can be used to login you have to think carefully about the trade-offs of security and convenience.

So in thinking about remember cookies you have to consider (at minimum)

  • The risks of someone having access to the browser who is not the original user. For example, what if the cookie is dropped on a computer in a public library and one user leaves and the next sits down.
  • The risks associated with someone copying the cookie and using it on a different computer (especially a problem where you see people using remember cookies on in house computers to avoid dealing with password resets and postits

  • The risk of someone being able to decrypt the authentication information in the cookie and use it either to gain access to your site or, if it contains (like many used to be and probably still are) some version of the user name and password does that not only make it possible to get access to your site but also potentially give access to other sites where the same password is used by the same user.

Personally, I would not use a permanent/20 year remember me cookie because of these problems and others like them. Yes, they are user errors (using the same password, checking remember me in the library, etc) but they are the kinds of human errors that happen. Not to mention that exceeds the life expectancy of the hardware. If you really have a user who has not logged in for 20 years I would think you would want him or her to provide credentials. (If they login in, you always should update and drop a new cookie, active users of remember me should not keep the same cookie for 20 years.)

Further if you use remember me you need to make sure to force real authentication when changing passwords, email address, other contact information and any ecommerce activities.

0

The usage of permanent cookies depends on how you use it. It can be an asset for improving user experience such as automatic login etc.. But remember that leaving a cookie for a long time might even turn into a vulnerability. So it's best to set the cookie to remain for how long you actually need it rather than opting for permanent thing.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.