How to build (and how not to build) a secure “remember me” feature
I tend to like doing: sha256(sha256($password) . $ip)This encrypts the password and makes the cookie only usable by the IP it was set for. Then to verify the cookie, since I already store sha256 of the password, it's trivial to do, without having to store an additional token for persistence. Of course you can replace sha256 with your fav hashing function.