Implementing remember-me in phoenix
<p>At first I chose to use <code>put_session</code> to store user id because session hash cannot be tampered. However it seems like session cookie only persist during the browser session. When the user re-opens the browser, it's gone and the user has to log in again.</p>

<p>I read that another option might be to generate a secure random token for each user and store it in the database and put it in a regular cookie with high expiration date. However, given that this cookie doesn't have  tampering protection AFAIK (but I might be wrong) and connection is not always https, I guess anyone listening to http in the middle between the user and the server would be able to hijack the user session.</p>

<p>Hence the question is how can I persist user id in session in a secure way? Or what are the other ways?</p>