Build a Safer PHP “Remember Me” Login with Rotating Tokens

A “remember me” checkbox creates a credential that lasts longer than the current browser session. Treat it like a password reset token: someone who steals it may gain account access until it expires or is revoked.

Store a verifier, not a reusable secret

Generate a cryptographically random token on the server. Put the opaque token in a cookie and store only a derived verifier in the database alongside the user, expiry and device metadata you genuinely need. Compare verifiers safely when the cookie returns. Avoid storing a plaintext token that grants access if the database is exposed.

Set the cookie with Secure on HTTPS, HttpOnly, an appropriate SameSite value and the narrowest practical domain and path. Define an expiry and do not extend it indefinitely without a deliberate product decision.

Rotate and revoke

After a persistent token is accepted, rotate it and invalidate the previous verifier. Consider how concurrent requests behave so a race does not log the user out unexpectedly. Revoke tokens on logout, password change, account recovery and administrator action according to the product's policy.

Keep a way for users to review and revoke remembered devices. Store only non-sensitive device labels; user-agent strings can be inaccurate and are not proof of identity.

Protect the login boundary

Regenerate the PHP session ID after authentication and continue to apply authorization checks on every request. A remembered token should establish a session, not bypass account permissions. Add rate limits and alerting appropriate to the service.

Test expiry, rotation, token reuse, logout and password reset. Persistent-login behavior is security-sensitive; keep the token flow small, documented and reviewed instead of building a custom cryptographic format.