Whenever a user visits the website, a session cookie is created in the user's system, that is set to expire after 15 years. Using this cookie data, I identify and authenticate the user.

The user also has a private url which he can use to login using other devices. Once logged in from this unidentified device, another cookie is created for the user but with a short time span. The user has the option to set the device as trusted which will result in the cookie expiry to be set at 15 years.