如何防止“记住我” cookie垃圾邮件？

Question

I have made a remember-me cookie system for my website (pure php). It works like this:

1. User logs in
2. A random token (user id + random sha256 hash) is generated and saved in a cookie for one month
3. The token is also stored in the database (mysql), together with its expiry date (1 month)
4. When user visits my site and has the cookie, I compare it's value with the one in database. If they match, I generate a new token for this cookie to prevent coookie-stealing

This allows users to be logged in from many devices simultaneously, but I ran into a (possible) problem. When using for example incognito mode, each time you view the website it asks you to login again (because there aren't any cookies obviously). This way, I can login hundreds of times and generate hundreds of tokens that will never be used again, but will take up space in my database and won't be deleted until their expiry date. How could I protect myself against that?

Answer 1

这是cookie的常见问题，因此为此设置了更短的到期日期，您还可以使用私钥将cookie值设置为包含任何会话信息或密钥信息的加密消息，这将解决所有问题