Securing Remember-Me Tokens in PHP

Remember-me cookies represent long-lived credentials and must be revocable.

What It Does

Remember-me cookies represent long-lived credentials and must be revocable. The following examples distinguish a normal use case, a boundary case and a practical application.

Requirements and Compatibility

PHP 8.x and a local test environment. Apply input validation, correct error handling and the requirements of any optional libraries.

The code focuses on the core concept. Production implementation may also need routes, validation, persistence, authorization or deployment tooling.

Example 1: Basic Behavior

Understand the primary operation and its inputs.

<?php
$selector = bin2hex(random_bytes(12));
$validator = random_bytes(32);
$storedHash = hash('sha256', $validator);
echo strlen($selector) . ':' . strlen($storedHash);

Example 2: Another Case

Check failure behavior or a different execution path.

<?php
$validator = random_bytes(32);
$storedHash = hash('sha256', $validator);
var_dump(hash_equals($storedHash, hash('sha256', $validator)));

Practical Example: Putting It to Use

Apply the behavior in a small, controlled scenario.

<?php
$cookieSettings = ['secure' => true, 'httponly' => true, 'samesite' => 'Lax'];
print_r($cookieSettings); // Rotate validator after successful use and revoke on logout

Important Behavior and Edge Cases

Store only a random selector and validator; hash validators in storage and rotate them on use.

Comparison with Related Functions or Approaches

Common Beginner Mistakes

Key Takeaways

• Remember-me cookies represent long-lived credentials and must be revocable.
• Store only a random selector and validator; hash validators in storage and rotate them on use.
• Session cookies are short-lived and distinct from persistent login credentials.

Before adapting these examples, verify the return values, test the failure paths and confirm that your application meets its security and environment requirements.