# Remember me cookie cakephp 4 not working

**URL:** <https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704>\
**Category:** Need Help\
**Created:** [December 7, 2020, 2:44pm UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704 "2020-12-07T14:44:14Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![vale\_a](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/vale_a/32/2054_2.png) [@vale\_a](https://discourse.cakephp.org/u/vale_a)\
**Post date:** [December 7, 2020, 2:44pm UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704/1 "2020-12-07T14:44:14Z")

</div>

I’m working with CakePHP 4.  
Following the documentation, I set up ‘remember me’ cookie, when I pass login, I see in the browser the CookieAuth controller with correct values for username e password.  
Point is that when I logout, I still see the cookie in my browser (it will expires in few days) but I expected username e password input text with precompiled value in the login form.  
Is this the correct behaviour?  
I tried to get these fields populated but incurred in many different errors related to cookie reading/writing e.g.  
“Argument 1 passed to Cake\Http\Response::withCookie() must implement interface Cake\Http\Cookie\CookieInterface, string given”

This is my code:

- in app\_local.php:  
‘Security’ =\> [  
‘salt’ =\> env(‘SECURITY\_SALT’, ‘string’, //here my random string  
],  
-in Application.php  
$cookies = new EncryptedCookieMiddleware(  
[‘CookieAuth’],  
Configure::read(‘Security.cookieKey’)  
);  
and inside getAuthenticationService(ServerRequestInterface $request), after Session and before Form:

- in UsersController, login function  
public function login()  
{  
$this-\>Authorization-\>skipAuthorization();  
$cookie = [‘email’=\>’’, ‘password’=\>’’, ‘remember\_me’=\>0];

-Templates\Users\login.php:

\<?= $this-\>Form-\>control('email', ['required' =\> true]) ?\> 

```
<?= $this->Form->control('password', ['required' => true]) ?> <!-- ,['value' => $cookie['password']] -->

```

\<?= $this-\>Form-\>control('remember\_me', ['type' =\> 'checkbox']);?\> \<?= $this-\>Form-\>submit(\_\_('Login')); ?\> 

Any help would be really appreciated, thanks.

---

<div class="post-metadata">

**Author:** ![Jawfin](https://avatars.discourse-cdn.com/v4/letter/j/dbc845/32.png) [@Jawfin](https://discourse.cakephp.org/u/Jawfin)\
**Post date:** [December 7, 2020, 10:18pm UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704/2 "2020-12-07T22:18:26Z")

</div>

I’m not answering the question, sorry, just asking another one: are you actually storing their password in plain text in a cookie on their PC? In which case that is a very bad thing. It would even be bad if you were storing their salted password hash (as a hacker with enough of these, gleaned from your user’s cookies, could perform some decryption [i.e. brute force one password for plain text/encrypted text and use rainbow tables etc.]).

I would suggest you direct your users to Lastpass or some similar app designed to do this.

As for answering your question, I have no input there, sorry again!!

---

<div class="post-metadata">

**Author:** ![vale\_a](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/vale_a/32/2054_2.png) [@vale\_a](https://discourse.cakephp.org/u/vale_a)\
**Post date:** [December 7, 2020, 10:35pm UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704/3 "2020-12-07T22:35:23Z")

</div>

Thanks for the suggestion, it’s just an example running on my laptop for personal use 😉

---

<div class="post-metadata">

**Author:** ![quapro83](https://avatars.discourse-cdn.com/v4/letter/q/f6c823/32.png) [@quapro83](https://discourse.cakephp.org/u/quapro83)\
**Post date:** [September 4, 2021, 4:49am UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704/4 "2021-09-04T04:49:15Z")

</div>

i tried it on version 4.x . It works fine

config/app.php

```auto
    'Security' => [
        'salt' => env('SECURITY_SALT', 'string'), //here my random string
        'cookieKey' => env('SECURITY_COOKIE_KEY', 'string'), //here my random string
    ],

```

Application.php | function middleware

```auto
->add(new EncryptedCookieMiddleware(
                ['CookieAuth'],
                Configure::read('Security.cookieKey')
            ))

```

Application.php | function getAuthenticationService

```auto
$service->loadAuthenticator('Authentication.Cookie', [
            'fields' => $fields,
            'cookie' => [
                'name' => 'CookieAuth',
                'expires' => (new Time())->addDays(30),
            ],
            'loginUrl' => '/users/login',
        ]);

```

```auto
<?= $this->Form->control('remember_me', ['type' => 'checkbox']);?>

```

---

<div class="post-metadata">

**Author:** ![Jawfin](https://avatars.discourse-cdn.com/v4/letter/j/dbc845/32.png) [@Jawfin](https://discourse.cakephp.org/u/Jawfin)\
**Post date:** [September 4, 2021, 12:51pm UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704/5 "2021-09-04T12:51:58Z")

</div>

Just a quick security question on that approach - is there any weakness in storing the salt in plain text on the client’s computer?

---

<div class="post-metadata">

**Author:** ![ndm](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/ndm/32/2234_2.png) [@ndm](https://discourse.cakephp.org/u/ndm)\
**Post date:** [September 4, 2021, 1:57pm UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704/6 "2021-09-04T13:57:40Z")

</div>

What approach are you referring to? I don’t see any of the samples above storing the salt in the cookie?

Generally it depends on what value specifically you are referring to, and how it is actually used. For example some encryption/hashing algorithms use random, dynamically generated salts and add them to the encrypted/hashed data, having those salts exposed is OK, their purpose is to protect against for example dictionary or rainbow table attacks.

Making say CakePHP’s `Security.salt` value public on the other hand would be a really, really bad idea, as it is a unique value this is even used as a key/secret in various places! Exposing this is like exposing a master password.

---

<div class="post-metadata">

**Author:** ![Jawfin](https://avatars.discourse-cdn.com/v4/letter/j/dbc845/32.png) [@Jawfin](https://discourse.cakephp.org/u/Jawfin)\
**Post date:** [September 4, 2021, 7:15pm UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704/7 "2021-09-04T19:15:33Z")

</div>

Sorry I misread.  
Wouldn’t the cookie also need to store the username?  
May not hurt to also put in some browser + PC identifier so if the cookie gets stolen it won’t grant a free pass to someone else.

---

<div class="post-metadata">

**Author:** ![ndm](https://yyz1.discourse-cdn.com/flex029/user_avatar/discourse.cakephp.org/ndm/32/2234_2.png) [@ndm](https://discourse.cakephp.org/u/ndm)\
**Post date:** [September 5, 2021, 12:37pm UTC](https://discourse.cakephp.org/t/remember-me-cookie-cakephp-4-not-working/8704/8 "2021-09-05T12:37:37Z")

</div>

Again I’m not sure what you’re referring to? The code of the original question? The sample posted by @quapro83? The general concept?