Client persistent storage not remembering user

[Cantor, Scott]

> Yes the point of the approach is avoiding stolen cookie.
> What do you mean by a lack of reliability ? You mean a bad reliability if the
> database shutdown or has too much load ?

Yes. You have a single point of failure. Most people don't cluster databases. This use case happens to tolerate a looser replicated store, but it's still pointless, there is no need for a database to prevent forgery. The advantage of the database is solely per-session revocation.

Stealing a cookie isn't the threat you're addressing, forgery is. Unless you address-bind the cookie, there is no mitigation to theft, no database solves that.

-- Scott