Remember-me uses a separate long-lived token

Extending the session lifetime to 30 days to implement 'remember me' means a stolen cookie is valid for a month with no way to revoke it on a per-device basis. CWE-613 (Insufficient Session Expiration) and CWE-287 (Improper Authentication) both cover this — the regular session has effectively lost its expiry guarantee. OWASP ASVS V3 (Session Management) treats persistent-login tokens as a separate authenticator class that must be individually revocable. A separate remember-me token stored server-side can be deleted individually, ending persistent login on one device without forcing a logout everywhere.

Issue a separate, revocable remember-me token distinct from the regular session cookie. Keep the regular session at its normal short TTL and use the remember-me token only to silently re-establish it:

// On login with remember-me checked:
const rememberToken = crypto.randomBytes(32).toString('hex')
await db.rememberTokens.create({
  data: { token: hash(rememberToken), userId, expiresAt: thirtyDaysFromNow }
})
res.cookie('remember_me', rememberToken, {
  maxAge: 30 * 24 * 60 * 60 * 1000,
  httpOnly: true, secure: true, sameSite: 'lax'
})
// Regular session cookie still expires in 1–7 days

On per-device logout, delete the specific remember token row. This leaves other devices unaffected while fully invalidating the target device.