0

Usually, signup forms don't have a "remember me" checkbox, but at the same time, you're logged in automatically after signing up so you don't use the login form (which has a remember me checkbox). So should I remember the user or not after they sign up?

My options are:

  1. Remember the user (con: people on shared computers might leave their account vulnerable)
  2. Don't remember the user (con: hassle to people on private devices, they'll need to log in again after they close this session)
  3. Add a "remember me" checkbox to the signup form (con: awkward? I've never seen such a thing)
2
  • For clarification, do you require email or phone verification before completing the registration process? Nov 8, 2022 at 22:11
  • @bloodyKnuckles I want the email verification to be a step after a successful registration, so a new user always gets redirected to a notice when logged in, and can log out anytime. Nov 10, 2022 at 0:21

3 Answers 3

1

Okay, after some thought, here is the option I'll choose and why I think it's the best:

  • Include a pre-checked checkbox on the registration page saying "keep me logged in".

Advantages:

  • the user doesn't have to click anything, so no hassle added to the user experience
  • the user will be reminded that the registration also logs them in, so if they forgot that they are not using a personal device, they will be reminded (by the presence of this checkbox) and uncheck it.

Disadvantages:

  • Can cause confusion? Because no other form ever has such checkbox, some users might be like "why would they have such a checkbox here??" but maybe they'll quickly realize "oh, it's literally the same function as the one in the login screen".

(I'm answering my question because no other answer gave a clear answer that says exactly what option to choose.)

2
  • '...pre-checked checkbox on the registration page saying "keep me logged in".' and '...if they forgot...they will be reminded...' — What are the odds some users will miss both of these AND be on a public computer. Nov 10, 2022 at 21:01
  • @bloodyKnuckles No you misunderstood, the reminder is the prechecked checkbox. So only one reminder... Nov 11, 2022 at 14:02
0

No, you shouldn't. There are security concerns as well as technical concerns

Security concerns include the obvious "using a shared computer" or "leaving a session open," as you said

As for the technical concerns, you send information to a DB. DB verifies that information and adds the user if it's valid. It becomes problematic if the data is invalid. Why would you want the system to remember invalid data?

One way to solve this problem is the behavior of native browsers. They offer you to save information even at signup. They do this via a dialog, so the user has more time to think about whether this is a good choice, or time for second thoughts (like "hey, no, this could be a security issue")

Bottom line: sometimes you've to rely on the millions of hours of user testing done by thousands of companies. And if no one uses a more or less trivial feature, then you've to assume there are good reasons not to introduce it.

5
  • Sorry, what are you talking about? I remember the user that was just created... What am I explaining wrong? Every single website logs you in when you sign up. Nov 8, 2022 at 21:07
  • I can guarantee that close to zero hours of "user testing" has been done by any company on the issue of whether people want to be logged in after they have signed up. Nov 9, 2022 at 7:38
  • @RationalFragile I'm answering the question of the "remember me" box. As you say, many sites log you in at signup (at least those that don't require confirmation)
    – Devin
    Nov 9, 2022 at 16:01
  • @Devin How can you say that there are "technical issues" when it works on every website ever? And you sill didn't answer the question, which option is better (or what should I do if you have a better option)? And browsers do not save your data, the server chooses to tell the browser to save a persistent cookie or a transient cookie. Nov 9, 2022 at 23:25
  • no, it doesn't work on "every website ever". Most sites require confirmation and nowadays it's hard to find a serious website not asking for 2FA. Anyway, if you don't like the answer it's OK, I don't feel like debating, just tried to help.
    – Devin
    Nov 10, 2022 at 15:45
0

If we assume the reason why people are signing up is to sign in to get access to the system, then the obvious UX would be to keep them signed in after account creation. That is what most commercial sites do, presumably to encourage usage/conversion and other reasons.

For reasons that are unclear, there has not been a convention of having a "remember me" option on signup as opposed to sign in. Selecting this option allows the system to pre-fill the username on the sign in screen later on.

As to the security issues of being "remembered" like this, the convention is not to set this on sign up, but instead offer this later as an option on sign in.


As an aside, this question also highlights an issue that could do with more research in terms of what people expect from the "remember me" option that often appears on sign in forms. For the last decade or more, these options have (from the point of view of the user of the system), done what their browser's password manager would do. Checking or un-checking the "remember me" would then seem to make no difference to the UX. But this is beside the question I think.

5
  • Thanks, but I literally said the cons of keeping the user logged in: it will cause people on public devices to forget their session indefinitely open on that device. Nov 9, 2022 at 23:31
  • What does "forget their session indefinitely open" mean? It's unclear what you are asking or what definition your are using for "Remember me" in this context. Nov 10, 2022 at 0:36
  • OK I think I know what you mean - I'll modify my answer and see. Nov 10, 2022 at 7:47
  • About forgetting your session, it means if you use a public device (like a friend's) and forget to use incognito, your account will be accessible if you don't log out. And yeah this is kinda stupid if you think about it, the user should always have some incognito option provided by the browser, but conventionally, websites don't rely on that and offer a checkbox to choose. Your answer now is better but still kinda just restates the options I said. I wish if an answer just tell me: this is the best option because of this and that. I still don't know what to do. Nov 10, 2022 at 16:34
  • I think I'll just add an already checked checkbox saying "keep me logged in" in the registration page as well. It will cost zero additional clicks but the user will be reminded that the session will be persisted indefinitely after signup (and can choose to uncheck it). Nov 10, 2022 at 16:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.