title: How to implement secure "Remember me"
body: <p>I am trying to figure out how to implement "Remember me" into an app that I am working on. Currently my implementation looks like this.</p>
  
  <ol>
  <li>User Signs in and requests to be remembered</li>
  <li>Server validates user with email/password</li>
  <li>If validation is successful, I generate a JSON web token using the user's email and a secret key stored on the server.</li>
  <li>The token is then sent as a cookie back to the client. But at the same time the token is hashed using bcrypt and store in the user's information in the database.</li>
  <li>Now, when the user visits the page later, the cookie is sent to the server when the page is loaded and validated against the stored hash in the database.</li>
  </ol>
  
  <p>To me this "seems" secure because the token essentially becomes the user's password and treated accordingly on the server side. However, I'm not sure if this is actually secure or if there is something I am missing.</p>