title: Codeigniter - Session expiration and "remember me" feature
body: <p>I'm building a "Remember Me" feature in Codeigniter, normally I see libraries/projects setting a cookie on the user with a token, this token gets saved in the database and is compared each time the user accesses the website.</p>
  
  <p>In Codeigniter we can set the session expiration time though, this lead me to try a different approach, this is what I did:</p>
  
  <ul>
  <li>I set the session_expiration in config to 0 (infinite session)</li>
  <li>If the user leaves "Remember me" unchecked, I set a 2 hour time in the session and session destroy on window close.</li>
  </ul>
  
  <p>So my login code looks like this:</p>
  
  <pre><code>if (!$this-&gt;input-&gt;post('remember_me')) {
                  $this-&gt;session-&gt;sess_expiration = 7200;
                  $this-&gt;session-&gt;sess_expire_on_close = TRUE;
              }
  
              $this-&gt;session-&gt;set_userdata($session_data);
  </code></pre>
  
  <p>And my config file:</p>
  
  <pre><code>$config['sess_expiration']      = 0;
  $config['sess_expire_on_close'] = FALSE;
  </code></pre>
  
  <p>I don't see people using this solution on projects, I have tested this out and it seems to work fine though.</p>
  
  <p>SO, for my question, would you say this a safe practice to do? Any security dangers I should know about? Any input on this solution vs cookie+database token would be great.</p>