Sometimes, I came across certain web development framework which doesn't provide authentication feature as in Authenication ASP.NET

I was wondering what is the security measure needs to be considered, when implementing "Remember Me" login feature, by hand coding?

Here are the things I usually did.

1) Store the user name in cookie. The user name are not encrypted.

2) Store a secret key in cookie. The secret key is generated using one way function based on user name. The server will verify secret key against user name, to ensure this user name is not being changed.

3) Use HttpOnly in cookie. http://www.codinghorror.com/blog/2008/08/protecting-your-cookies-httponly.html

Any things else I could miss out, which could possible lead a security hole.