The first answer mentions a couple of time that any token given to the user (for remember-me login or password reset) should be hashed in the database.
Would it be possible to replace the whole storing by signing the token with some private key, so that the validity of the token can be checked without having to compare it to some stored value ?
Would it be possible to replace the whole storing by signing the token with some private key, so that the validity of the token can be checked without having to compare it to some stored value ?