Securely implementing session state and 'keep me logged in' feature

Question

I would like to improve security on a current application regarding session management and I want the users to be logged in until they explicitly logout.

How does one implement that securely?

Keep session information in database, like sessionid, ip, useragent?

Please provide the requirements, possibly a database layout, do's and don'ts, tips and tricks.

Note: I know frameworks like asp.NET, rails, codeigniter, etc... already take care of that, but this is not an option. Actually it for a classic asp application. But I think this question does not relate to a specific language.

Answer 1

Create a cookie with a ridiculous expiry like 2030 or something. If you need session state, keep a session ID in the cookie (encrypted if security is priority) and map that to a table in a database. IP/UserAgent etc. tend to be meta-data, the cookie is the key to the session.

Answer 2

Read Improved Persistent Login Cookie Best Practice (both the article and comments).

Answer 3

You should know that such a system cannot be secure unless you use https.

It's quite simple:

1. User logs in.
2. The server sends the user a cookie with an expire date far in the future.
3. If you want, you can record the IP of the user.
4. User requests another page.
5. The server checks the cookie (possibly the IP stored with the cookie), sees that the user is logged in, and servers the page.

Some security considerations:

As stated above, there is no secure way unless you use https.

If you're using shared hosting, try to find out where your cookies are stored. Often they reside in the /tmp directory, where every user as access to and through that someone could possibly steal your cookies.

Track the IP, if you know that the computer isn't ever going to change it.

Don't store any information in the cookie. Just store a random number there and store the information belonging to it on the server in a database. (Not sensitive information like preferred colour can be stored in the cookie, of course.)