tags:

views:

123

answers:

1
+1  Q: 

Why not use Cookies for Authentication instead of sessions?

I would like to persist the user authentication between user sessions (basically a "remind me" by default).

Sessions expire while cookies persist: why should I use a session for authentication and then another different cookie for the "remind me"?

Can't I simply store a cookie whith a token and use it for both authentication and persistence?

A: 

Here are some links explaining why using cookies for authentication is bad from security viewpoint:

DVK  2009-09-25 17:48:58
These links doesn't really respond to my question... use a "remind me" still seems to dissolve any advantage that the use of sessions may have brought! Security of a site that uses a reminder and a site that use a cookie for the whole process of authentication have the same level of security: am I wrong?
collimarco  2009-09-25 18:24:31

related questions

Is there a rake task for backing up the data in your database?
How to represent cross-model information in MVC?
WYSIWYG editor gem for Rails?
Best Solution For Authentication in Ruby on Rails
Acts-as-readable Rails plugin Issue
Associating source and search keywords with account creation
Any tips on getting Rails to run with an Access back-end?
Being as DRY as possible in a Ruby on Rails App
How Do You Secure database.yml?
What IDE to use for developing in Ruby on Rails on windows?
Is Ruby On Rails ready for the Enterprise?
OpenID authentication in Ruby on Rails
Why Doesn't My Cron Job Work Properly?
Why does sqlite3-ruby-1.2.2 not work on OS X?
Ruby mixins and calling super methods
Why all the Active Record hate?
Haml: how do I set a dymanic class value?
Learning Ruby on Rails any good for Grails?
How to sell Python to a client/boss/person with lots of cash
How do I create a new Ruby on Rails application using MySQL instead of SQLite?
Ruby On Rails with Windows Vista - Best Setup?
What is good forum software to add to an existing Rails application?
How do I fix 'Unprocessed view path found' error with ExceptionNotifier plugin in rails 2.1?
Frequent SystemExit in Ruby when making HTTP calls
Implementation of "Remember me" in a Rails application.