3 ms·
If you want to do this, at least make the login cookie expire at the end of the session. I had a friend forward me an OKCupid e-mail when they sent mis-matches
by newhouseb 15y ago
If you want to do this, at least make the login cookie expire at the end of the session.
I had a friend forward me an OKCupid e-mail when they sent mis-matches for April Fools - a few days later I realized that I had somehow been logged in as said friend and was majorly creeped out. Had I been less mature about it there was major potential for trolling said friend - particularly on OKC.
- danenania 15y agoMistakes like this will inevitably occur even with a cookie that expires as you suggest. Not as often as with a non-expiring token, but there are plenty of people who will leave a browser tab up for days at a time, keeping the session alive. The convenience is tempting but it seems careless.