If checked, authToken lasts for 6 months or a year. Otherwise it lasts for 24 hours or less.

pixelfck 22 Apr 2015:

Hmm.
Your suggestion is not in line with what is commonly used in the industry. Remember me functionality is very easy to get wrong if you invent your own wheel, while the secure solution is not that hard.

If the 'remember me' option is not checked, the session cookie should not have an expiry date. In effect, the cookie will live until the browser closes (a so called 'session cookie' with regards to lifetime).

If the 'remember me' option is checked, the system should allow the user to be re-authenticated every time he visits the site. Upon visiting the site, you should create a session cookie just as you would for a normal log-in.
The difference is that instead of logging the user in based upon username and password, you log in the user automatically based upon a token (128bit random data should do). On the server side, you store a hash (BCrypt, PBKDF2 with 10000+ iterations or SCrypt) of said token.
Upon logging in the user, you invalidate the used token and give a new, randomly created token to the user.
If the user decides to sign out, invalidate his token and delete the token cookie.
Ideally, you also give the user the option to 'sign out on all devices', which you would effect by invalidating all tokens for said user.