# Cake PHP 3.5 Auth remember me

**URL:** <https://discourse.cakephp.org/t/cake-php-3-5-auth-remember-me/4027>\
**Category:** Need Help\
**Created:** [March 8, 2018, 5:59pm UTC](https://discourse.cakephp.org/t/cake-php-3-5-auth-remember-me/4027 "2018-03-08T17:59:31Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![ifjuszalaimihaly](https://avatars.discourse-cdn.com/v4/letter/i/b5e925/32.png) [@ifjuszalaimihaly](https://discourse.cakephp.org/u/ifjuszalaimihaly)\
**Post date:** [March 8, 2018, 5:59pm UTC](https://discourse.cakephp.org/t/cake-php-3-5-auth-remember-me/4027/1 "2018-03-08T17:59:31Z")

</div>

Helllo!

I use [https://book.cakephp.org/3.0/en/controllers/components/authentication.html](https://book.cakephp.org/3.0/en/controllers/components/authentication.html) Auth component. How can I add to this remember me option?

Thanks!

---

<div class="post-metadata">

**Author:** ![dmuenstermann](https://avatars.discourse-cdn.com/v4/letter/d/b9bd4f/32.png) [@dmuenstermann](https://discourse.cakephp.org/u/dmuenstermann)\
**Post date:** [March 9, 2018, 9:53am UTC](https://discourse.cakephp.org/t/cake-php-3-5-auth-remember-me/4027/2 "2018-03-09T09:53:47Z")

</div>

When you only want to “remember” the username, you could set a cookie for that. Though I would’t recommend to set the password in that cookie also (for security reasons, obviously…)

If you want to get the user automatically logged in, whenever he/she visits your site, I’m currently not aware of any (secure) variant to achieve this…

Hope this helps

---

<div class="post-metadata">

**Author:** ![lafeber](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/lafeber/32/956_2.png) [@lafeber](https://discourse.cakephp.org/u/lafeber)\
**Post date:** [March 9, 2018, 5:29pm UTC](https://discourse.cakephp.org/t/cake-php-3-5-auth-remember-me/4027/3 "2018-03-09T17:29:55Z")

</div>

I also don’t think that remembering user/pwd in a cookie is very safe. People should leave this to client side solutions, like a password manager. The alternative is using SSO. You could even have people log in using Facebook. Not my personal preference, but it can be done. 🙂

---

<div class="post-metadata">

**Author:** ![Zuluru](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/zuluru/32/1230_2.png) [@Zuluru](https://discourse.cakephp.org/u/Zuluru)\
**Post date:** [November 26, 2018, 5:27pm UTC](https://discourse.cakephp.org/t/cake-php-3-5-auth-remember-me/4027/4 "2018-11-26T17:27:44Z")

</div>

The new Authentication plugin includes functionality for this. It’s just an extra authenticator you can enable in the middleware. The password is encrypted in the cookie. Up to you to decide whether that’s an acceptable level of risk for your application.