title: PHP Persistent Login - Regenerate Login Token
body: <p>I am trying to implement a PHP persistent login solution to protect some admin pages on a website I'm working on, using this SO answer as the basis:</p>
  
  <p><a href="https://stackoverflow.com/questions/3128985/php-login-system-remember-me-persistent-cookie">PHP login system: Remember Me (persistent cookie)</a></p>
  
  <p><strong>After Logging In</strong></p>
  
  <pre><code>if ($login-&gt;success &amp;&amp; $login-&gt;rememberMe) { // However you implement it
      $selector = base64_encode(openssl_random_pseudo_bytes(9));
      $authenticator = openssl_random_pseudo_bytes(33);
  
      setcookie(
          'remember',
           $selector.':'.base64_encode($authenticator),
           time() + 864000,
           '/',
           'yourdomain.com',
           true, // TLS-only
           true  // http-only
      );
  
      $database-&gt;exec(
          "INSERT INTO auth_tokens (selector, token, userid, expires) VALUES (?, ?, ?, ?)", 
          [
              $selector,
              hash('sha256', $authenticator),
              $login-&gt;userId,
              date('Y-m-d\TH:i:s', time() + 864000)
          ]
      );
  }
  </code></pre>
  
  <p><strong>Re-Authenticating On Page Load</strong></p>
  
  <pre><code>if (empty($_SESSION['userid']) &amp;&amp; !empty($_COOKIE['remember'])) {
      list($selector, $authenticator) = explode(':', $_COOKIE['remember']);
  
      $row = $database-&gt;selectRow(
          "SELECT * FROM auth_tokens WHERE selector = ?",
          [
              $selector
          ]
      );
  
      if (hash_equals($row['token'], hash('sha256', base64_decode($authenticator)))) {
          $_SESSION['userid'] = $row['userid'];
          // Then regenerate login token as above
      }
  }
  </code></pre>
  
  <p>My question is that I don't understand what is meant by this section in the "Re-Authenticating On Page Load" section:</p>
  
  <pre><code>// Then regenerate login token as above
  </code></pre>
  
  <p>Which is the login token it's referring to - does that mean this bit:</p>
  
  <pre><code>$selector = base64_encode(openssl_random_pseudo_bytes(9));
  </code></pre>
  
  <p>Or this bit:</p>
  
  <pre><code>$authenticator = openssl_random_pseudo_bytes(33);
  </code></pre>
  
  <p>And once I have done that, do I have to:</p>
  
  <ol>
  <li>Add another row to the "auth_tokens" table</li>
  <li>Re-generate the cookie to include the new token value?</li>
  </ol>
  
  <p>I've been trying various options for persistent logins all week, and this has almost got me there, but I'm stumbling at this last block.</p>