I'm building a "Remember Me" feature in Codeigniter, normally I see libraries/projects setting a cookie on the user with a token, this token gets saved in the database and is compared each time the user accesses the website.

In Codeigniter we can set the session expiration time though, this lead me to try a different approach, this is what I did:

  • I set the session_expiration in config to 0 (infinite session)
  • If the user leaves "Remember me" unchecked, I set a 2 hour time in the session and session destroy on window close.

So my login code looks like this:

if (!$this->input->post('remember_me')) {
                $this->session->sess_expiration = 7200;
                $this->session->sess_expire_on_close = TRUE;
            }

            $this->session->set_userdata($session_data);

And my config file:

$config['sess_expiration']      = 0;
$config['sess_expire_on_close'] = FALSE;

I don't see people using this solution on projects, I have tested this out and it seems to work fine though.

SO, for my question, would you say this a safe practice to do? Any security dangers I should know about? Any input on this solution vs cookie+database token would be great.

php codeigniter
Edit
Report