What is the most secure way to do a cookie based "Stay logged in"?
<p>Hi
what is the securest way to do a "stay logged in" feature?</p>

<p>i think thinking of user logs in store their userid, timestamp and a hash of <code>timestamp + salt + hash of their pw</code> in a cookie. then when they visit the site next, check if a hash of the <code>cookie timestamp + salt + hash of their pw</code> is valid</p>

<p>(ie... (untested, and ignore lack of mysql_real_escape_string())</p>

<p>(this is in php)</p>

<pre><code> /*
 cookie contains these fields:
 username
 timestamp
 hash
 */

 $row  = mysql_fetch_array($result); 
            ## sql would be something like select salt,
            ## username from users where user = $_COOKIE['username']

 $generated_cookie_data = my_hash_func(
            $_COOKIE['timestamp'] . 
            $row['salt_from_db'] .
             my_hash_func([$row['password'])
             )

 if ($generated_cookie_data == $_COOKIE['hash']) {
 #logged in!
 }
 else {
 #not logged in!
 }
</code></pre>
