我为 Web 应用程序编写了一个附加组件，它将“记住我”复选框插入到登录表单中。我的一位用户对注销后不被记住感到惊讶！显然，已注销的人应该保持注销状态，尽管有特定请求，我也不会填写密码字段，因为这意味着以明文形式存储密码。
我的问题是，如果用户之前标记了“记住我”框，是否应该预先填写登录表单的电子邮件地址/用户名？
显然，如果在公共计算机上完成，将有效地将他们的个人详细信息广播给使用该计算机的下一个陌生人，但用户无论如何都不应该在公共计算机上使用“记住我”选项。
这样做的安全考虑是什么？用户是否希望在注销后记住他们的一些详细信息？
编辑：我发现浏览器都有一个功能来记住表单值和登录详细信息，也许这没有必要。
I've written an add-on for a web application that inserts a "Remember Me" checkbox into login forms. One of my users expressed surprise that they are not remembered after logging out! Clearly someone who has logged out should stay logged out, and despite a specific request I will not fill the password field as that means storing the password in clear text.
My question is should the email address/username be pre-filled for a login form if a user has previously marked the "Remember Me" box?
Obviously if done on a public computer that would be effectively broadcasting their personal details to the next stranger who used that computer, but a user shouldn't use the "Remember Me" option on public computers anyway.
What are the security considerations of doing this? Do users expect some of their details to be remembered after logging out?
Edit: It occurs to me that browsers all have a feature to remember form values and login details anyway, perhaps making this unnecessary.
发布评论
评论（3）
如果有人使用了“记住我”功能，您绝对不应该预先填充电子邮件/登录名。请记住，此功能（通常也称为“保持登录状态”）旨在跨会话保持登录状态。这是一项可用性功能，可让用户在每次访问网站时免于重新进行身份验证。
它不是在显式注销后保留登录凭据任何部分的方法。是的，浏览器可以记住表单字段值，例如登录名，但大多数安全指南明确建议禁用此功能（请参阅 面向 .NET 开发人员的 OWASP Top 10 第 3 部分：损坏的身份验证和会话管理）。
就安全系统而言，我当然不认为用户会仅仅因为绝大多数网站不以这种方式运行而期望预先填充这些数据。如果在明确同意的情况下降低进入门槛是可以的，但当用户明确退出或结束其会话时，或者当行为与他们的期望不一致时，就不行了。
You should absolutely not pre-populate the email / login if someone has used the "remember me" feature. Keep in mind that this feature - also often called "keep me signed in" - is designed to persist the logged-in state across sessions. It's a usability feature to save the user from re-authenticating every time they visit the site.
It's not a means of persisting any part of the login credentials after explicitly signing out. Yes, the browser can remember form field values such as the login name but most security guidance explicitly recommends disabling this (refer to OWASP Top 10 for .NET developers part 3: Broken authentication and session management).
In terms of security systems, I certainly don't think there's any user expectation to pre-populate this data simply because the vast majority of websites don't operate in this fashion. Lowering the barrier to entry is fine if it's done with explicit consent, but not when the user has specifically signed out or ended their session and not when the behaviour is inconsistent with what they'd expect.
“记住我”与“让我保持登录状态”不同。
许多银行网站甚至在用户注销后也使用“记住我”来保存用户名（但不保存会话）（ING Direct 和 Citizens Bank 就是几个例子）。出于安全目的，他们通常会隐藏部分姓名。
为了让用户清楚地了解情况，您可能需要将措辞更改为“保持登录状态”或类似的内容。
"Remember me" is not the same thing as "keep me signed in."
Many banking sites use "remember me" to save the username (but not the session) even after the user has logged out (ING Direct and Citizens Bank are a couple of examples). They usually hide part of the name for security purposes.
To make things clear for your users, you probably want to change the wording to "stay signed in" or something similar.
假设他们的电子邮件地址被用作他们的用户标识符，这是我期望的行为，并且经常在许多我不期望其具有高安全级别的应用程序中看到这种行为。
更安全的实现是存储加密的标识符，并且仅在用户尝试登录时询问密码。这是我在持有我的金融网站的网站上看到和期望的行为。确保浏览器不记得密码字段对于此类网站非常重要。
最好在复选框旁边放置关于不要在公共计算机上使用“记住我”的警告。
Assuming their email address is the being used as their user identifier, this is the behavior I expect and frequently see from many applications that I don't expect high levels of security from.
A more secure implementation it to store an encrypted identifier and only ask for the password when the user tries to login. This is the behavior I see and expect from sites that hold my financial sites. Ensuring the browser doesn't remember the password field is important for such sites.
It is good practice to place a warning about not using "Remember me" on public computers next to the check box.