andig/videodb — pull request #42 by Plotin (2013-12-15 11:47:17+00:00)
Title: Changed RememberMe Cookie to allow multiple devices

The current "remember me" cookie solution only supports remembering on one device/browser. If you log into another device, another cookie will be generated and you'll get logged out of the first device. With increasing numbers of devices, this kinda sucks ;-)

The change proposed here changes the way the cookie is generated. Instead of using a random number it uses a user-dependend deterministic, yet "unguessable (if you don't know the password)" way to create the cookie code. That way it is possible to stay logged in on multiple devices.

I have not really given security much thought. Cookie stealing comes to mind, but the existing solution doesn't prevent stealing either, so it won't be worse I think ;-)

A better solution might be to allow cookies for individual devices/browsers and implement a secure way those cookies are used (i.e. invalidate the cookie after each use and issue another one) but that would have needed a larger scale change and a database update for which I do not have time at the moment.