Intermediate LevelAuthentication & Authorization
How do you design a secure "Remember Me" persistent authentication feature?
❓ Interview Prompt: Explain persistent login security (Charles Miller pattern), selector and validator token pairs, and timing attack prevention.
Naive "Remember Me" features store user IDs or hashed passwords in long-lived cookies, creating severe security vulnerabilities.
Secure "Remember Me" Pattern (Selector / Validator Pattern):
1
When user checks "Remember Me", generate two high-entropy random tokens:
•
Selector: Public token used to lookup the DB record.
•
Validator: Secret token used to verify identity.
2
Server stores: 'Selector' and 'SHA-256(Validator)' in DB.
3
Cookie stores: 'remember_me = selector + ":" + validator' in an 'httpOnly, Secure' cookie.
4
When validating, server looks up record via 'Selector' and compares 'SHA-256(Validator)' using timing-safe comparison.
5
Token Rotation: Issue a brand-new selector/validator pair on every single automatic login!
Code Implementation Example
typescript
import crypto from 'crypto';
function createRememberMeTokens() {
const selector = crypto.randomBytes(16).toString('hex');
const validator = crypto.randomBytes(32).toString('hex');
const validatorHash = crypto.createHash('sha256').update(validator).digest('hex');
const cookieValue = selector + ":" + validator;
return { selector, validatorHash, cookieValue };
}💡Generating selector and hashed validator token pair for Remember Me cookie.
🎯 Interview Key Takeaway
Design Remember Me features using Selector and Hashed Validator token pairs, rotating tokens on every login.
#Remember Me#Persistent Login#Tokens#Security#Intermediate
Back to all Authentication & Authorization Questions→