Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

What is the typical pattern regarding remembering users for a website? Do you offer to remember the user at login and when they register, or at login only, or either depending on what mood you are in :) ? Not interested in implementation details, just the recommended practice?

share|improve this question
add comment

5 Answers

Please offer to remember the user when he signs up, and when he logs in. I type in enough usernames/passwords each day as it is. If you can reduce it by one, I'm very appreciative. :)

share|improve this answer
add comment

I usually require some email verification after registration, and when the email is verified, the user needs to login. Then the user can choose "Remember Me" there.

share|improve this answer
add comment

Really you're talking about a trade-off between speed of access and security. It's a question of which your particular application requires more, and/or which you personally prioritise. That's my answer to whether to implement it at all.

As for whether to implement it at login or at registration (or both), I believe the convention is to offer it at the login stage. I've seen some sites offer it at the registration stage but by and large it's a check box next to the "log in" button.

share|improve this answer
add comment

To answer this question, you must first study what is the purpose of your website users when they register/login.

In general,

  • when the user registers, it's for accessing as fast as possible something which cannot be accessed by guests. In this case, she must be logged in once registered (and this is not optional), to avoid your users wasting their precious time.

  • when the user is already registered, returns after some time and logs in, there are chances she will log in again later. Offering "Remember me" option must be done in this case.

Now, it's important to study the precise case, because maybe your users don't behave the same way. For example, I would not appreciate if my bank website will remember me at every logon, and I will never need the "Remember me" option.

share|improve this answer
add comment

If your site doesn't really need it's own login credentials, use OpenID. See Jeff Atwood's post on this. If it's good enough for StackOverflow, it's good enough for your site. ;)

But, if you really really need your own credentials, most sites just say a user can't login until they have verified. In practice, that is normally what you see. An email verification with a link that will mark the account as active.

The reason why is so that a person or bot can't have free reign on your site before they have verified their account. Forums come to mind off the top of my head. If a user can live in a state of registered limbo and post trolling comments, that's bad. If a bot can register for your site and start spamming b/c they don't need a valid email, again, that's bad.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.