Am I the only one confused by the new Remember Me functionality?

Karie Kelly1

If you actually log out of the application (which we often are requested in terms of working with applications and having clean sessions), the message says that the Remember Me option is cleared. Why is Remember Me tied to logout?

In my experience, Remember Me means when i go to the login, my credentials are populated, but I log in. It doesn't tie to log out. I log out and when I go back to the login, it should know my credentials and allow me to click login.

This is how it used to work a few weeks bug (not a new bug); but Monday's release changed the overall logic - am I mistaken or is this the behavior typically experienced by others using Remember Me logic?

Norman Abramovitz

There are two ways to look at the remember my login. One way is the way you thought about it related to the login.

The other way it is tied to the logout. Your encrypted credentials are remembered if you close the browser. When you reopen the browser, those encrypted credentials are used again. When you logout, you are stating explicitly you want your encrypted credentials removed.

If it is only tied to the login, it is alittle harder to get your encrypted credentials removed. In that case you need to clear your cookie cache or have some other functionality built into the application.

if you tie the remember me to login , then when someone else uses your account, they will not be prompted to login, even if you logged out.

So, it is slightly more secure having the remember me tied to logout than login since the next person will be prompted to login if you did logout.