Member Avatar for Naters_uk

I am using to create a login page. I would like to create a remember me cookie using a checkbox that will help to remember user ID but will also allow it to be destroy if a different user ID wants to log in with the same computer, but i have no idea how to start. Any assistance? Thank you! :cry:

  • 4 Contributors
  • 3 Replies
  • 996 Views
  • 5 Years Discussion Span
  • Latest Post Latest Post by crishjeny

Dani AI

Generated

Several useful directions already appear in this thread: points to the built-in forms-auth approach, while and show manual cookie examples. The manual examples illustrate the basic idea, but storing usernames/passwords in a client cookie is unsafe and should be avoided.

A safer, practical pattern that works with ASP.NET WebForms or newer stacks is token-based persistent login:

  • On successful login (when "remember me" is checked) generate a long, cryptographically secure random token.
  • Store only a hash of that token in a server-side table with user id, device info, expiry and a revoke flag.
  • Place the raw token in a persistent cookie with Secure, HttpOnly and an appropriate SameSite attribute; set a sensible expiry (e.g., 14-90 days depending on risk).
  • On each request, if the cookie exists validate the token against the stored hash and sign the user in server-side. If validation fails, ignore the cookie.
  • On logout, password change, or "forget this device", delete the server token row and expire the cookie so a different user can sign in.

Example workflow (pseudo):

# login (remember checked)
token = SecureRandom(32)
Store(hash(token), userId, expiry, device)
SetCookie("remember", token, Expires=30d, HttpOnly=True, Secure=True, SameSite=Strict)

# on request
token = Request.Cookie["remember"]
if token and Validate(hash(token)) then SignIn(userId)

Do not store passwords client-side. Always require HTTPS, use HttpOnly/Secure/SameSite, rotate/revoke tokens on password changes, and offer a "forget this device" option so another user can sign in from the same machine. Built-in FormsAuthentication or ASP.NET Identity can manage persistent cookies for you, but the token pattern adds server-side revocation and better control.

Member Avatar for cambia

You might start with Forms Authentication in .NET. It automates the "remember me" cookie with the following method call.

FormsAuthentication.SetAuthCookie(userName, saveLogin);

Here's a place to begin learning more:
MSDN Documentation for SetAuthCookie Method

Cheers,
- Steve

Member Avatar for fullget

here is some code you can find it use full

Partial Class _Default
    Inherits System.Web.UI.Page

    Protected Sub Page_Load(ByVal sender As Object, ByVal e As System.EventArgs) Handles Me.Load
        If Not IsPostBack Then
            'Check if the browser support cookies
            If Request.Browser.Cookies Then
               'Check if the cookies with name PBLOGIN exist on user's machine
                If Request.Cookies("PBLOGIN") IsNot Nothing Then
                    'Pass the user name and password to the VerifyLogin method
                    Me.VerifyLogin(Request.Cookies("PBLOGIN")("UNAME").ToString(), Request.Cookies("PBLOGIN")("UPASS").ToString())
                End If
            End If
        End If
    End Sub

    Protected Sub BtLogin_Click(ByVal sender As Object, ByVal e As System.EventArgs)
        'check if remember me checkbox is checked on login
        If (Me.CbRememberMe.Checked) Then
            'Check if the browser support cookies
            If (Request.Browser.Cookies) Then
                'Check if the cookie with name PBLOGIN exist on user's machine
                If (Request.Cookies("PBLOGIN") Is Nothing) Then
                    'Create a cookie with expiry of 30 days
                    Response.Cookies("PBLOGIN").Expires = DateTime.Now.AddDays(30)
                    'Write username to the cookie
                    Response.Cookies("PBLOGIN").Item("UNAME") = Me.TbUserName.Text
                    'Write password to the cookie
                    Response.Cookies("PBLOGIN").Item("UPASS") = Me.TbPassword.Text
  'If the cookie already exist then wirte the user name and password on the cookie
                Else
                    Response.Cookies("PBLOGIN").Item("UNAME") = Me.TbUserName.Text
                    Response.Cookies("PBLOGIN").Item("UPASS") = Me.TbPassword.Text
                End If
            End If
        End If

        Me.VerifyLogin(Me.TbUserName.Text, Me.TbPassword.Text)
    End Sub

    Protected Sub VerifyLogin(ByVal UserName As String, ByVal Password As String)
        Try
            'If login credentials are correct
                 'Redirect to the user page
            'else
                 'prompt user for invalid password
            'end if
        Catch ex as System.Exception
            Response.Write(ex.Message)
        End Try
    End Sub

    Protected Sub lbSignout_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles lbSignout.Click
 'Check iIf the cookies with name PBLOGIN exist on user's machine
        If (Request.Cookies("PBLOGIN") IsNot Nothing) Then
            'Expire the cookie
            Response.Cookies("PBLOGIN").Expires = DateTime.Now.AddDays(-30)
        End If

        'Redirect to the login page
    End Sub
End Class
Edited by Ezzaral because: Added code tags and snipped url. Keep it organized and keep it on site.
Member Avatar for crishjeny

Hi

you can refer the following code for remember cookie.

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<%
If request.form("remember") = "ON" Then
' Set cookie(s) to expire at later date, for example
response.cookies("username") = value
response.cookies("username").Expires = (Date+365)
End If
%>
<html>
<head>
<?xml version="1.0" encoding="iso-8859-1"?>
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<meta name="description" content...............................................................................................................<p class="main2"><form method="post" action="verify.asp" name="hemilog">
<p align="center" class="main2">Username:
<input type="text" name="username" size="30" value=""<%=Request.cookies("username")%>>
<br /><br />
Password:
<input type="password" name="pwrd" size="30" value=""<%=Request.cookies("username")%>>
<br /><br />
<input type="checkbox" name="remember" value="ON" checked> remember me<br />
<input type="submit" name="cmdsubmit" value="Log-In">
</p>
</form></p>................................................</html>
Edited by Ezzaral because: Added code tags. Please use them to format any code that you post.
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.