How to handle the expiration of a "remember me" option?

Question

For a cookie based "remember me" function on a web app the user can choose to stay logged in for X days:

What do you think is better:

a) set the expiration time of the "remember me" only at first login, so the cookie expires after X days after the first login?

or

b) re-set the expiration time each time the user logs in, so the cookie would expire X days after the last login?

What do you think would a user expect?

Answer 1

Good question. Best option might be to ask actual users. After all, they'll have to live with your decision :-).

But personally I'd vote for b). Normally the point of expiration is that the login will expire when you no longer use the computer and therefore no longer need the login. So it makes sense to start the expiration timer only when the user no longer actively uses the login.