title: How to store cookies containing sensitive data securely in PHP?
body: <p>I would like for my users to have the capability of "Keep me logged in" when they log in to my website. At the suggestion of the top answer on this post, <a href="https://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach">&quot;Keep Me Logged In&quot; - the best approach</a>, I decided to hash a combination of the user's salt and password in one cookie and store the user's id (a number) in another cookie. Of course, the hash value will also be stored on a database server-side to be validated when the user returns again. The salt value I used is the same one that I used to hash the password of the user when they first register, so it is static - it doesn't change between sessions. There's a few of problems I see with this approach.</p>
  
  <p>1) Is using the registration salt a good idea if it's static or should I generate a different salt each time for the cookie?</p>
  
  <p>2) If someone were to gain access to the cookies and they copy them to a different computer, and then try accessing the website from that computer, theoretically, it will automatically log them in to that user's account, is this not a security issue?</p>
  
  <p>3) In a scenario where some user with malicious intents were to gain access to the database, a secure website would have salted and hashed passwords making it rather difficult for the hacker to gain access into multiple accounts (if at all). But, by simply playing around with the hash and salt values and creating a cookie that matches the values they've changed on the database, they can effectively get access to any account they want, rendering the whole password-hashing process as useless. Therefore, this cookie approach I'm using now is compromising my entire database and all my users' accounts.</p>
  
  <p>So my question is, how do I store a cookie in PHP with sensitive information such as a hash of the user's password without having to worry about the aforementioned issues? Surely websites like Gmail and Hotmail, who offer this "Keep me logged in" feature follow a more secure approach than what I'm doing now, so how would they do it?</p>