Comments on: Creating a Persistent Login Mechanism

By: Jeremy Cook

Jeremy Cook — Wed, 01 Feb 2012 21:47:26 +0000

Good point and to be totally truthful I’m not entirely sure why I suggested two fields. In my defense I wrote that quite a while ago.. The only reason for the two random fields is that it obfusticates things a little more. If an attacker was able to observe a number of cookies they might be able to work out that the ones called ‘pl’ have a common purpose. However, that would only provide a negligible benefit. It looks like one db field would be quite enough.

By: Craig

Craig — Tue, 31 Jan 2012 11:11:26 +0000

Thanks for the article, useful pointers, I’m building something very similar.

Any reason you don’t just do something like

cookieName=”pl” (for persisted login)
cookieValue=”BigRandomGarbagesdffjkshjdifhioshdfijsdfjisdjfsdf”

I can’t see any good reason for two DB fields, could you explain your reasoning a bit more?

Thanks,

Craig