จะเขียน device cookie ยังไงครับ? ยังไม่เข้าใจกระบวนการของมันหลายอย่างด้วยครับ?

<?php
session_start();

?>
<form method="post" action="login.php">
    <input type="text" name="username" value="" placeholder="Username"><br>
    <input type="password" name="password" value=""><br>
    <button type="submit">Login</button>
</form>

<?php
/**
 * Device cookies with authenticate user to prevent brute-force attack
 *
 * @link https://www.owasp.org/index.php/Slow_Down_Online_Guessing_Attacks_with_Device_Cookies OWASP reference.
 */
 
 
session_start();


// assume that this username & password is in DB.
$username = 'admin';
$password = '$2y$10$/FRHJxB0GuW82R9uo2wNu.Hq.FADk522Nvg.BY90wwkbomjBRE6kK';// pass


if (!$_POST) {
    header('Location: form.php');
    exit();
}


if ($_POST) {
    // Entry point for authentication request ----------------------------------------------
    if (isset($_COOKIE['deviceCookie'])) {
        // 1. if the incoming request contains a device cookie
        // --- a. validate device cookie
        if (validateDeviceCookie() === true) {
            /*if (?HOW TO CHECK DEVICE COOKIE IN LOCKOUT LIST?) {
                // c. if the device cookie is in the lockout list
            } else {
                // else
                // authenticate user
                authenticateUser();
            }*/
        } else {
            // b. if device cookie is not valid then proceed to step 2.
            // reject authentication attempt
            rejectAuthentication();
        }
    } /*elseif (?HOW TO AUTHENTICATE UNTRUSTED CLIENTS?) {
        // 2. if authentication from untrusted clients is locked out for the specific user
        // --- reject authentication attempt
        rejectAuthentication();
    }*/ else {
        // 3. else
        // --- authenticate user
        authenticateUser();
    }
}// endif;


/**
 * Authenticate user.
 */
function authenticateUser()
{
    global $username, $password;

    // 1. check user credentials
    if (isset($_POST['username']) && $_POST['username'] == $username) {
        if (isset($_POST['password']) && password_verify($_POST['password'], $password) === true) {
            // รหัสผ่านถูก
            $credentialValid = true;
        } else {
            // รหัสผ่านผิด
            $credentialValid = false;
        }
    } else {
        // ชื่อผู้ใช้ผิด
        $credentialValid = false;
    }

    if ($credentialValid === true) {
        // 2. if credentials are valid
        // --- a. issue new device cookie to user’s client
        issueNewDeviceCookie();
        // --- b. proceed with authenticated user
        echo 'login success.';
        exit();
    } else {
        // 3. else
        // --- a. register failed authentication attempt
        // --- ?HOW TO REGISTER FAILED AUTH?
        // --- b. finish with failed user’s authentication
        echo 'wrong username or password!';
        exit();
    }
}// authenticateUser


/**
 * Issue new device cookie to user’s client.
 */
function issueNewDeviceCookie()
{
    $login = ($_POST['username'] ?? 0);
    $nonce = md5(random_bytes(32));
    $secretKey = generateRandomString();
    $signature = hash_hmac('sha256', $login . ',' . $nonce, $secretKey);

    // assume that signature will be in more secure place.
    setcookie('deviceCookie', $login . ',' . $nonce . ',' . $signature . ',' . $secretKey, (time() + (120 * 24 * 60 * 60)), '/');
}// issueNewDeviceCookie


/**
 * Reject authentication attempt.
 */
function rejectAuthentication()
{
    echo 'Unable to authenticate (rejected).';
    exit();
}// rejectAuthentication


/**
 * Validate device cookie.
 */
function validateDeviceCookie()
{
    global $username;

    if (isset($_COOKIE['deviceCookie'])) {
        $cookieValue = $_COOKIE['deviceCookie'];
        list($login, $nonce, $signature, $secretKey) = explode(',', $cookieValue);
        if ($_POST['username'] . ',' . $nonce . ',' . $signature . ',' . $secretKey === $cookieValue) {
            // 1. Validate that the device cookie is formatted as described above
            if (
                hash_equals(
                    hash_hmac('sha256', $_POST['username'] . ',' . $nonce, $secretKey),
                    $signature
                )
            ) {
                // 2. Validate that SIGNATURE == HMAC(secret-key, “LOGIN,NONCE”)
                if ($login === $username) {
                    // 3. Validate that LOGIN represents the user who is actually trying to authenticate
                    return true;
                }
            }
        }
    }

    return false;
}// validateDeviceCookie


/**
 * Generate random string
 *
 * @link https://stackoverflow.com/a/4356295/128761 Original source code.
 */
function generateRandomString($length = 10) 
{
    $characters = '0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ';
    $charactersLength = strlen($characters);
    $randomString = '';
    for ($i = 0; $i < $length; $i++) {
        $randomString .= $characters[rand(0, $charactersLength - 1)];
    }
    return $randomString;
}// generateRandomString