Is remember-me secure?

Any feature related to security that has been added for user convenience has the potential to expose our carefully protected site to a security risk. The remember-me feature, in its default form, runs the risk of the user’s cookie being intercepted and reused by a malicious user. The following diagram illustrates how this might happen:

Figure 7.3 –Remember-me session cookie replay attack

The use of Secure Sockets Layer (SSL) (covered in the Appendix, Additional Reference Material) and other network security techniques can mitigate this type of attack, but be aware that there are other techniques, such as Cross-Site Scripting (XSS), that can steal or compromise a remembered user session. While convenient for the user, we don’t want to risk financial or other personal information being inadvertently changed or possibly stolen if the remembered session is misused.

Important note

Although we don’t cover...