r2c/user/plugins/login/vendor/birke/rememberme

Secure "Remember Me"

This library implements the best practices for implementing a secure "Remember Me" functionality on web sites. Login information and unique secure tokens are stored in a cookie. If the user visits the site, the login information from the cookie is compared to information stored on the server. If the tokens match, the user is logged in. A user can have login cookies on several computers/browsers.

This library is heavily inspired by Barry Jaspan's article "Improved Persistent Login Cookie Best Practice". The library protects against the following attack scenarios:

• The computer of a user is stolen or compromised, enabling the attacker to log in with the existing "Remember Me" cookie. The user knows this has happened. The user can remotely invalidate all login cookies.
• An attacker has obtained the "Remember Me" cookie and has logged in with it. The user does not know this. The next time he tries to log in with the cookie that was stolen, he gets a warning and all login cookies are invalidated.
• An attacker has obtained the database of login tokens from the server. The stored tokens are hashed so he can't use them without computational effort (rainbow tables or brute force).

Installation

composer require birke/rememberme

Usage example

See the example directory for an example.

Improving security

The generated tokens are pseudo-random and the storage classes use the SHA1 algorithm to hash them. If you need better security than that, overwrite the Authenticator::generateToken method to generate a truly random token. If you are using PHP >=5.5 you can use the "password_hash" and "password_verify" functions. On lower PHP versions you could use the userland implementations of these functions.