Now sessions eventually expire in PHP, and if you sign in and being authenticated only relies on the
session.
This might mean that your users would have to log in a couple times a day.
It might be enough that they stop using your service or your website for, let's say, an hour or two
hours, and they would have to log in again, which might be very inconvenient.
That's why often with authentication, with logging in, you might see a feature called Remember Me.
And it's supposed to sign you in for longer periods of time, for example, two weeks or maybe even
one month.
And now in the next couple videos, we're going to implement this feature as it is a non-trivial feature.
Let's start for the diagram and the changes that are related to the remember Me feature.
Try and just describe this.
Remember Me feature in a simplistic way.
So we need to go back to this point where we compare the passwords when someone tries to log in.
Now we've got this new feature, Remember Me?
There would be a checkbox and if someone wants his session to be longer, then that's the new things
that we need to add.
So we remember that sessions are temporary by design.
If you have no activity for, let's say, 30 minutes to couple hours, depending on how you have configured
sessions in PHP, well, you will be logged out automatically.
Your session would be destroyed.
Thus there will be no user ID in the session.
It means you will no longer be authenticated.
Now to fight this and let users have longer sessions so they don't have to authenticate a couple times
a day, Today we add this Remember Me feature.
The way it works is we're going to create and store a so-called remember token in the database.
It's going to have an expiry date.
You can customize that.
It can be two weeks or one month.
And additionally to creating and storing such a remember token, which is just an random set of characters,
it is a generated token.
So we're going to store it in a database.
But also we will store such token in a cookie.
So cookies are stored in a browser, and they are always automatically sent with every request by the
browser.
And you can set the expiry date on the cookies as well.
And the way things would work right now to figure out if someone is logged in, we're gonna either try
to get his user ID from the session.
But if that expires.
So the session expires and someone wanted to be remembered, then we're gonna try a second method.
So the token is stored in a cookie.
We're going to use this token and find the database record.
The remember token inside the database using this very token.
And every remember token is always connected to a specific user.
And this is how we're going to fetch the user.
And that's the way we're gonna figure out we are authenticated.
Additionally, for extra security, every single time we retrieve the user by his remember token, we're
gonna rotate this token, meaning we are going to regenerate the token every single time it's being
read to authenticate the user.
And this is just a security Precaution because those who remember my tokens, they are really long lived.
Two weeks or one month.
This is a really long time, and in this time, it's easy that this token could just land in wrong hands
and then someone else can impersonate the user, basically taking over his account.
Now you also need to understand and you need to be aware of this, that this Remember Me feature is
not 100% safe and it is a potential risk.
So nothing's free.
It's just more user convenience.
But there are some risks involved.
That's why we try to or we will try to mitigate the risks by rotating the token.
Okay.
So that was the explanation of what we are going to do and how.
Now let's just start building this feature.