The user_id is currently stored in the session, instead it should store a token in a cookie so the user will be remembered when coming back. This unique token will need to be generated upon creating each user.
I'm thinking this unique token can also be used for login through other services. For example, if I supply an API, an iPhone app or other app can log-in through the token so one doesn't need to give away his password.
Alternatively I can turn this into an OAuth provider, but I don't know how that would work when logging in through another OAuth server such as Twitter. Hmm.
The
user_id
is currently stored in the session, instead it should store a token in a cookie so the user will be remembered when coming back. This unique token will need to be generated upon creating each user.I'm thinking this unique token can also be used for login through other services. For example, if I supply an API, an iPhone app or other app can log-in through the token so one doesn't need to give away his password.
Alternatively I can turn this into an OAuth provider, but I don't know how that would work when logging in through another OAuth server such as Twitter. Hmm.