Greetings great people on the Internet. I present to you, a question we are dealing with.
Case: The user checks the "Remember Me" checkbox
Question: How long should the session be active? So the user won't need to login.
Standard Symfony puts this on 1 year but we're worried the user will not remember the set password after a year. So should we increase or decrease this value?
We're aware of the security risks and it won't be a default action.
Really looking forward to the answers!
Users forget passwords - this is a given. Some are forgetful, some are careless and some just don't care. You need to deal with this anyway - whatever length you choose for a remember-me session, some users will have forgotten.
You can't optimize the length of your remember-me session to maximize the number of users who remember their password - that will come out to zero time.
Instead, choose a length that suits your context. If your app is used intensively for a few days once a month (or quarter or year), set the session length long enough that users only need to log in once per month (or quarter or year). If your app is used all the time, look after your regular users by setting this to a long span - a year is reasonable.
Do offer users a link for logging out - to cancel the effect of remember-me.
Aside - your word choice "the set password" worries me. You are going to let users set a personal and private password that's unique to them, right?
