Take the 2-minute tour ×

I am researching how to implement a persistent "remember me" type cookie for a site. I was just wondering is using a GUID for a security token as secure an an md5 hash of username and password?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

A GUID is more "secure", because there's no possibility of information disclosure in a random identifier. Otherwise, were the username to be known, the password could be extracted using a per-username rainbow table or a concerted attack since you did not add salt before hashing. NB: MD5 is a rather weak hash at this point.

Long story short, if you don't need to store private information in cookies for really really good reasons, don't. Use a random token instead.

share|improve this answer
So it would be good practice to use a GUID for a security token in persistent cookies? –  chobo Jan 29 '12 at 1:34
@chobo Yes, that's fine. So long as you don't give access to anything based solely on the cookie... Obviously you can't set a stay-logged-in-forever cookie and maintain security, because the cookie could be stolen. This is how sessions work: cookie stores a random ID, random ID is associated with a server-side database. –  Borealid Jan 29 '12 at 1:36
I was planning to store the guid token in the same table as the username and password and do a lookup on both username and token, if they match (user is authenticated) and I would generate a new token and update the cookie and token fields in the database, so it would be a one use token. –  chobo Jan 29 '12 at 2:04
@chobo I don't see anything wrong with that. –  Borealid Jan 29 '12 at 2:20

Your Answer


