4 ms·

I've explored this in the past. Wouldn't it be possible to simply set two 1yr cookies one at the mid-expiry point of the second. Then re-set the first when it e

• sp332 10y ago
  But if the user resets their password, it should log out all the user's sessions. But you have to wait for the cookies to time out before they are re-authenticated. (Or make a check on every request to see if the password has been changed, which is just a pain.)
  • bryanlarsen 10y ago
    You don't check on every request to see if the password has changed, you check to see that the session is valid on every request. You should be doing that anyways. Then all you have to add is a way for password changes to invalidate the session.
    • azdle 10y ago
      The thing is that the way that a session is usually "validated" these days is to just store a userid in some serialized format then encrypt that and send it off as a cookie that expires in a relatively short amount of time (and hopefully put the expire time in the encrypted message too). Then the server just has to try to decrypt the cookie and if it results in a valid userid then the session is valid. This way you don't cause an extra database request for every user request. I'm not saying it's good or secure, but it's the way I often see it done/suggested to be done.
  • Kequc 10y ago
    I figure if you need to re-issue or initially issue the two cookies you set one of them to expire after 6mo and the other 1yr.
  • ddalex 10y ago
    Or you can just forget about the cookie on the server side - you don't need to expire anything.