Take the 2-minute tour ×
User Experience Stack Exchange is a question and answer site for user experience researchers and experts. It's 100% free, no registration required.

I've just finished a well-thought login validation mechanism and have asked myself the following question several times:

What does the user expect when he checks the Remember me checkbox in an enterprise application?

So, should I store only the username or the password alongside it, so the user gets logged-in right away when he starts up the application? Or should I simply save the username and have the user re-enter the password all the time?

I'm not asking whether or how to save the remembered password, that'd be a question for security.stackexchange.com and not ux.

This application (not necessarily mine) is used daily in a high frequency, so also remembering the password would be a good idea. But would it? Or wouldn't it? What does the user expect?

I've also considered implementing some kind of expiring-algorithm, but I do not fancy that so I'm now asking the experts: You!

share|improve this question
    
Might you try surveying your users to find out what they expect? It's a good question but sounds like you might have the opportunity to get the right directly from the people who will be clicking that checkbox. –  Sullivan Aug 28 '13 at 20:56
    
Please bear in mind that depending on the subject, enterprise application not only have to deal with authentication but with authorization as well. Allowing someone to be left signed in may open up a permissions can of worms... –  Marjan Venema Aug 30 '13 at 12:20

2 Answers 2

up vote 1 down vote accepted

This is mostly a security question, however, traditionally the "Remember Me" checkbox places a session cookie in the user's browser so as to "automatically" log the user in. Making the checkbox "remember" the user's username/password is a feature best left to the browser and could be unintuitive for users accustomed to the normal behavior.

I would go with the normal route of creating a session cookie - like you said, you can have this cookie expire to increase the security of the method. There is likely a very standard way of doing this depending on the technologies you are using to host/run your website.

Edit: Sullivan also has the good suggestion of naming this feature more properly (i.e., "Stay signed in").

share|improve this answer
3  
You can also take Google's lead and change the language. Their checkbox says "Stay signed in" which is much more direct than "Remember Me" since the latter leaves an open question of what is being remembered. –  Sullivan Aug 28 '13 at 21:00
1  
Thank you for your answer, I might add this is not primarily based on a web application but also to desktop applications. Hence you ain't got no cookies and "stay signed in" collides a bit with that, I suppose. –  SeToY Aug 29 '13 at 9:47
    
@SeToY The same practice still applies with desktop applications; typically you will store the user's credentials (or a login token) locally and automatically log the user in when they return to your application. –  Joshua Barron Aug 29 '13 at 13:47
    
This is not clear. The first paragraph seems to contradicts itself. –  Nicolas Barbulesco Dec 20 '13 at 9:07
    
@NicolasBarbulesco What is unclear? –  Joshua Barron Dec 20 '13 at 14:48

Users like me expect to be fully remembered : name and password.

But the best approach depends on the context.

In a sensitive environment, it may be wiser to remember only the name, without password. And this would involve educating the users, otherwise the users would anyway have their computer remember the password.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.