Autologin for web application

Question

We want to AutoLogin feature to allow user directly login using link into our Web Application. What is the best way achieve this?

We have following approches in our mind.

1) Store user credentials(username/password) in cookie. Send cookie for authentication.

e.g. http: //www.mysite.com/AutoLogin (here username/password will be passed in cookie)

OR Pass user credentials in link URL.

http: //www.mysite.com/AutoLogin?userid=<>&password=<>

2) Generate randon token and store user random token and user IP on server side database.

When user login using link, validate token and user IP on server.

e.g.

http: //www.mysite.com/AutoLogin?token=<>

The problem with 1st approach is if hacker copies link/cookie from user machine to another machine he can login.

The problem with 2nd approach is the user ip will be same for all users of same organization behind proxy.

Which one is better from above from security perspective? If there is better solution which is other than mentioned above, please let us know.

Answer 1

Which one is better from above from security perspective?

Both are bad, but storing passwords in the clear text is a sin. Please don't even consider it.

If there is better solution which is other than mentioned above, please let us know.

Don't implement auto-login. Its never going to be secure.

Answer 2

The only secure "auto-login" is a cookie that gets set after a normal login and is verified when the user comes back to the site. The cookie should expire after a reasonable amount of time. Your first approach is similar to this, but you haven't explained how their username and password get stored in a cookie in the first place. Instead of storing those in plaintext, store a series of cookies that contain, at the minimum:

1. their username
2. an expiration time
3. a SIGNED hash of the previous items. Signed means that the hash includes a secret that is known only to the site and never given out to anyone. When the cookies come back to you, re-sign the first two items, and compare the signature to the one in their cookie. If it matches, you know it came from you and wasn't tampered with, so you can let them in.