Is this possible to keep login credentials alive using PHP?

You can increase session timeout using PHP. If you want your session to stay alive until the browser is closed you can simply set session.gc_maxlifetime to 0:

ini_set('session.gc_maxlifetime', 0);

If you want infinite session you can set session.gc_maxlifetime to:

 ini_set('session.gc_maxlifetime', 60 * 60 * 24 * 365); # session expires after 1 year

Otherwise you can set session.gc_probability to 0 before starting the session. This will give the garbage collector a 0% chance of removing session data. You have to do this in all applications that share the same session storage location.

 ini_set('session.gc_probability', 0);

You can also change these values from the php.ini file

If u need more information about php.ini variables check the php documentation: https://www.php.net/manual/en/session.configuration.php#ini.session.gc-probability

You can use php $_SESSION or COOKIE for this

$_SESSION['USER'] = ['current user details']; 

You can combine both cookie and session for great experiance as a beginer use seasion first

You cant set expiry date of cookie morethan 2038 or it will wrap up

This is called OAauth Authentication. Every company that provides an OAuth auth (as Google, Facebook, Amazon, Github, etc.) will give you the documentation instructions about how doing it the proper way.

Anyway, you will have to own your own authentication logic that will serve any of the options described, and you will have to implement each of them, one by one. After authenticating your user, you will have to keep the created session as usual in any application.

In fact, it's Open Id Connect that allow user to connect in the way you described.

Oauth2 has been developped few years ago. It's an authorization protocol that means it's basicly for managing data access. It has several flows to work depending of what you want to do.

OpenId Connect it's an overlayer that's implements an authentication process over the Oauth2 flow. In fact Oauth2 and OpenId Connect are complementary. 90% of OpenId Connect is in fact Oauth2. The rest is the part that make Oauth2 usable for authentication

The fact that documentations on the internet uses different flows makes it more complex to understand

I don't think that I'm saying is actually clear and it's a wide subject. I have struggled a lot to understand how does it works. The moment when I really understood how does it work it's when I've seen this video on youtube. Yes, it last an hour but probably save days.

• Cookies are how a website identify a user in order to keep a session alive even when the browser is restarted.
• Cookies should not be used for storing login credentials. Only a unique session identifier generated by the server to recognize the device when it visits the website later.
• Cookies must expire at some point in the future but you can set its expiration date to years later.
• Cookies can be set from the client-side using JavaScript's document.cookie or from the server-side (more practical for session handling ) by PHP through the Set-Cookie HTTP response header which can be done manually using the PHP header function or better using the setcookie function or easier let the php handle the whole session handling processes for you using its builtin session functions.

What you're looking for is called PHP Session. You can use PHP session to create 'alive' pages for your user for custom user experience. Sessions are relatively secure than cookies since they are stored in server computer, but as @Anirudhsanthosh mentioned, you can use both for better experience.

Here's a tutorial on how you can use PHP Session to create a login page.

Basic idea is, when user enters username and password:

1. Check if that username and password to what you've stored in database.

2. If username and password matches, you can store given user information in a session variable as $_SESSION['user'] = $username;

3. On every page where you have to give access to only logged in user, check if the user is logged in as:

   if(!isset($_SESSION['user'])){
   // REDIRECT TO LOGIN PAGE
   }
   

PS: Don't forget to start session on beginning of every page as session_start();

The login procedure is not as the same as you think. Facebook, google and other websites are not keeping login credentials until user logs out.

There are two major ways that you can use to authenticate users to your website.

• OAuth is one way where users have to provide there username and password each and every time when they access the website. To do that you have store username and password in Cookies or somewhere, then you can pass them with every request

if you need to store login credentials as cookies you can do it like this,

document.cookie = 'username=username; expires=Sun, 1 Jan 2023 00:00:00 UTC; path=/'

BUT DON'T DO THIS!

Storing Login credentials is high security risk.

2. OAuth2 is the most secure way. Lets assume that one user is trying to login to your website for the first time. When he enters username and password your web server validates them and if they are correct, server will send a Token back. Token is a Long String which is harder to be guessed or brute forced.

Then you can store that token in cookies

document.cookie = 'token=tokenhere; expires=Sun, 1 Jan 2023 00:00:00 UTC; path=/'

and pass the token with each and every request. So the server can validate user requests without login credentials.