You’re right about the responsive web demo. The checkbox currently just changes the label text; it doesn’t persist anything. The message saying the browser will remember the preference is misleading.
Session.Authenticate(...) authenticates the current logical web session. It doesn’t create a persistent login cookie or restore authentication when someone returns later.
For “remember me”, I’d recommend a separate, cryptographically random token:
- Put the token in a persistent
HttpOnly, Secure cookie with an appropriate SameSite setting and expiry.
- Store a hash of it server-side, associated with the user and an expiry date.
- When the user returns, validate it server-side before authenticating their new session.
- Revoke the token and delete the cookie on sign-out.
That follows the general approach described in OWASP’s session management guidance.
The awkward part in Objo currently is connecting that flow to the browser session. WebRequestHandler can read and set cookies through WebRequest and WebResponse, but it runs separately and has no access to the browser’s WebSession. Those cookie APIs alone therefore don’t provide a complete solution for a WebPage-based login.
You haven’t overlooked a simple “remember me” option. I’ve logged a feature request for proper remember-me support, including a working example, covering persistent sign-in, expiry, revocation, documentation, and correcting the existing demo.