If you need to ask, I recommend starting with an existing implementation that has been vetted by security folks smarter than you or I.
I use Devise, based on Warden, for Ruby on Rails. Depending on your platform, that may not work for you.
I use Devise, based on Warden, for Ruby on Rails. Depending on your platform, that may not work for you.
I use Warden and saw there was a rememberable strategy in Devise that I could use.
I also read I can secure the cookies to be only send over SSL. I was hoping some further explanations on that since Devise doesn't seem to do it.
Unfortunately, most Rails apps run without SSL, so that's not going to be the default any year soon. At this point, you really do have to pay money for a good SSL certificate, or self-sign and then people have to click through an ominous-looking dialog to use your site.