[scotty79]

Or you can do this:

Client generates random value, puts it into cookie and passes it to server along with valid credentials. Server remebers it for this user and whenever at later time it sees this value in the cookie it logs in this user. Server forgets this value when this user logs out and after some time.

If client does't have javascript or you don't trust randomness it can generate you can create this value on server and make the server set this cookie when it responds to login.

[brown9-2]

What is the point of generating this value on the client? The second scenario you describe seems to work the same, minus the need to generate values on the client, with the same outcome.

[scotty79]

I guess no point. Pick the one that you feel better with.

[scotty79]

Also the server should keep it hmac-ed in case db silently leaked.