For AI agents: llms.txt is a short guide that sends you to the rules your problem needs, and rules.json holds every rule of this playbook as JSON.

Applies when

The project it has user accounts.

How to do it

NIST SP 800-63B-4 says "remember my browser" cookies shall not be used instead of authentication. OWASP treats them as a risk signal, never a replacement. So the person still proves the first factor each time. Thirty days matches the longest overall time-out NIST suggests for a single-factor session. Store a random token per user and device, kept as a hash, as lock down session cookies builds session IDs. Mark a sign-in that used it as single-factor. Then ask again before changing how someone logs in still asks for the second factor. Show remembered devices in the session list. Forget them all when the password changes, a factor is removed or someone reports "This wasn't me".

Examples

Using these examples: they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

JavaScript example

const REMEMBER_DAYS = 30;
const DAY_MS = 24 * 60 * 60 * 1000;

export async function mustAskSecondFactor(db, user, rememberToken) {
  if (user.isAdmin || !rememberToken) return true;
  const device = await db.rememberedDevices.findByHash(user.id, sha256(rememberToken));
  return !device || Date.now() - device.createdAt > REMEMBER_DAYS * DAY_MS;
}

Python example

REMEMBER_FOR = timedelta(days=30)

def must_ask_second_factor(db, user, remember_token: str | None) -> bool:
    if user.is_admin or not remember_token:
        return True
    device = db.remembered_devices.find_by_hash(user.id, sha256(remember_token))
    return device is None or datetime.now(UTC) - device.created_at > REMEMBER_FOR

How to check

Sign in with the box ticked, sign out and sign in again. The password is asked and the code is not. Change the email, and the code is asked. Move a fake clock 31 days, and the code is asked again. A test admin is always asked.

Sources

• NIST SP 800-63B-4 on browser cookies
• NIST SP 800-63B-4 on AAL1 reauthentication
• OWASP Authentication Cheat Sheet on risk-based authentication

Related rules

• Lock down session cookies in Security testing
• Ask again before changing how someone logs in in Security testing
• List every signed-in device in Accounts