PHP Persistent Login - Regenerate Login Token
<p>I am trying to implement a PHP persistent login solution to protect some admin pages on a website I'm working on, using this SO answer as the basis:</p>

<p><a href="https://stackoverflow.com/questions/3128985/php-login-system-remember-me-persistent-cookie">PHP login system: Remember Me (persistent cookie)</a></p>

<p><strong>After Logging In</strong></p>

<pre><code>if ($login-&gt;success &amp;&amp; $login-&gt;rememberMe) { // However you implement it
    $selector = base64_encode(openssl_random_pseudo_bytes(9));
    $authenticator = openssl_random_pseudo_bytes(33);

    setcookie(
        'remember',
         $selector.':'.base64_encode($authenticator),
         time() + 864000,
         '/',
         'yourdomain.com',
         true, // TLS-only
         true  // http-only
    );

    $database-&gt;exec(
        "INSERT INTO auth_tokens (selector, token, userid, expires) VALUES (?, ?, ?, ?)", 
        [
            $selector,
            hash('sha256', $authenticator),
            $login-&gt;userId,
            date('Y-m-d\TH:i:s', time() + 864000)
        ]
    );
}
</code></pre>

<p><strong>Re-Authenticating On Page Load</strong></p>

<pre><code>if (empty($_SESSION['userid']) &amp;&amp; !empty($_COOKIE['remember'])) {
    list($selector, $authenticator) = explode(':', $_COOKIE['remember']);

    $row = $database-&gt;selectRow(
        "SELECT * FROM auth_tokens WHERE selector = ?",
        [
            $selector
        ]
    );

    if (hash_equals($row['token'], hash('sha256', base64_decode($authenticator)))) {
        $_SESSION['userid'] = $row['userid'];
        // Then regenerate login token as above
    }
}
</code></pre>

<p>My question is that I don't understand what is meant by this section in the "Re-Authenticating On Page Load" section:</p>

<pre><code>// Then regenerate login token as above
</code></pre>

<p>Which is the login token it's referring to - does that mean this bit:</p>

<pre><code>$selector = base64_encode(openssl_random_pseudo_bytes(9));
</code></pre>

<p>Or this bit:</p>

<pre><code>$authenticator = openssl_random_pseudo_bytes(33);
</code></pre>

<p>And once I have done that, do I have to:</p>

<ol>
<li>Add another row to the "auth_tokens" table</li>
<li>Re-generate the cookie to include the new token value?</li>
</ol>

<p>I've been trying various options for persistent logins all week, and this has almost got me there, but I'm stumbling at this last block.</p>