longest lasting cookie

Question

I want to keep a user logged in as long as possible. What should I use?

• regular cookie
• persistent cookie
• flash cookie
• ip address
• session

or some combination of these?

Answer 1

I think a Flash cookie would probably stay around the longest for the simple reason that most people don't clear them too often. They don't show up in the usual browser dialogs and aren't cleared by the usual "clear cookies" feature.

Trying to tie a user to an IP address is useless and downright insecure if you're trying to keep people logged in. IP addresses change often and you shouldn't rely on it for anything serious.

I guess the best thing to do is use both a normal browser cookie and a Flash cookie. That way you catch all the Flash-less users (or those who block Flash by default) just in case.

Answer 2

Its unclear what "long as possible" means. Forever, even if the user cycles the power on their PC? Or simply as long as the browser process is running (assuming browser here)?

For the latter just use a volatile (session) cookie.

For the former use a persistent cookie with a very future expiry.