CODEWITHSUNDEEP
javascriptphpjqueryhtml
Sagar Rawal
Sagar Rawal

Reputation: 81

Add Remember Functionality in Website to load same page when url is loaded

I am making an app with local Html files inside the assets folder in android studio. When opened it first open index.html files as specified. As it is routine application, I was wondering if I could add Remember this functionality, such that when user loads application, they'll get automatically redirects to the same page they have checked and also provides Reset in case they want to reset their choice in future.

Any Help would be greatly appreciated.

Upvotes: 0

Views: 65

Answers (1)

Fotis Grigorakis
Fotis Grigorakis

Reputation: 361

Improved Persistent Login Cookie Best Practice

You could use this strategy described here as best practice (2006) or an updated strategy described here (2015):

  1. When the user successfully logs in with Remember Me checked, a login cookie is issued in addition to the standard session management cookie.
  2. The login cookie contains a series identifier and a token. The series and token are unguessable random numbers from a suitably large space. Both are stored together in a database table, the token is hashed (sha256 is fine).
  3. When a non-logged-in user visits the site and presents a login cookie, the series identifier is looked up in the database.
    1. If the series identifier is present and the hash of the token matches the hash for that series identifier, the user is considered authenticated. A new token is generated, a new hash for the token is stored over the old record, and a new login cookie is issued to the user (it's okay to re-use the series identifier).
    2. If the series is present but the token does not match, a theft is assumed. The user receives a strongly worded warning and all of the user's remembered sessions are deleted.
    3. If the username and series are not present, the login cookie is ignored.

This approach provides defense-in-depth. If someone manages to leak the database table, it does not give an attacker an open door for impersonating users.

Upvotes: 3

Related Questions