6

Greetings great people on the Internet. I present to you, a question we are dealing with.

Case: The user checks the "Remember Me" checkbox

Question: How long should the session be active? So the user won't need to login.

Standard Symfony puts this on 1 year but we're worried the user will not remember the set password after a year. So should we increase or decrease this value?

We're aware of the security risks and it won't be a default action.

Really looking forward to the answers!

1 Answer 1

5

Users forget passwords - this is a given. Some are forgetful, some are careless and some just don't care. You need to deal with this anyway - whatever length you choose for a remember-me session, some users will have forgotten.

You can't optimize the length of your remember-me session to maximize the number of users who remember their password - that will come out to zero time.

Instead, choose a length that suits your context. If your app is used intensively for a few days once a month (or quarter or year), set the session length long enough that users only need to log in once per month (or quarter or year). If your app is used all the time, look after your regular users by setting this to a long span - a year is reasonable.

Do offer users a link for logging out - to cancel the effect of remember-me.

Aside - your word choice "the set password" worries me. You are going to let users set a personal and private password that's unique to them, right?

1
  • 1
    I think this is a good answer. In my experience users don't have any set expectations around how long they will be remembered for unfortunately so it's often ends up being about what the business wants to get out of users sessions duration
    – Chris
    May 13, 2016 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.