Remember me function not working

atlet · March 15, 2022, 8:57am

I crated a new project with CakePHP 4.2 and cakedc/users plugin (9.2). If I login and thick box remember me, cookie is crated but it’s not working properly as I get logged out in about an hour (session duration). Any hints where to check what can be wrong? I followed the installation instructions of plugin.

KevinPfeifer · March 15, 2022, 10:50am

The default remember me functionality creates a cookie with the name CookieAuth

So you should have at least 3 cookies set after logging in:

PHPSESSID
CookieAuth
csrfToken

If you delete the PHPSESSID cookie its like you waited 1h (or whatever your default session timeout is set therefore expiring the session)
But for me at least the CookieAuth persists which has an expire duration of month and I am still logged in

atlet · March 15, 2022, 11:04am

Yes, I have all the 3 cookies. If I delete PHPSESSID I get logged out.

KevinPfeifer · March 15, 2022, 6:22pm

Well my test-install is on current CakePHP 4.3 and therefore latest CakeDC/Users 11 but still its basically the same logic as in 9.2

All I can say is that in vendor/cakedc/users/src/Loader/AuthenticationServiceLoader.php function loadAuthenticators($service) the authenticators are getting added in the order they are present in the Config Key Auth.Authenticators which should be

Session
Form
Token
Cookie
Social
SocialPendingEmail

See users/users.php at 9.next · CakeDC/users · GitHub

Since deleting the PHPSESSID Cookie therefore prevents the SessionAuthenticator to return a successful result the next one should be the CookieAuthenticator (which is overwritten by a CakeDC Custom Authenticator Class but that part shouldn’t be affected by it)

Did you overwrite some config in your config/users.php related to the CookieAuthenticator?

atlet · March 16, 2022, 10:13am

No.

I checked and all authenticators get loaded.

atlet · March 16, 2022, 1:19pm

I upgraded to last version of plugin (11) and to CakePHP 4.3, but still don’t work.

KevinPfeifer · March 16, 2022, 1:40pm

Well then let me step you through where my CookieAuthenticator succeeds

As already said above it starts with the loop of all loaded authenticators in vendor/cakedc/auth/src/Authentication/AuthenticationService.php

In there the $result = $authenticator->authenticate($request); check is if the given request is valid for the used authenticator.

github.com

CakeDC/auth/blob/6.next-cake4/src/Authentication/AuthenticationService.php#L148

      
        
            public function authenticate(ServerRequestInterface $request): ResultInterface
            {
                if ($this->authenticators()->isEmpty()) {
                    throw new RuntimeException(
                        'No authenticators loaded. You need to load at least one authenticator.'
                    );
                }
            
            
    $result = null;
                foreach ($this->authenticators() as $authenticator) {
                    $result = $authenticator->authenticate($request);
                    if ($result->isValid()) {
                        $skipTwoFactorVerify = $authenticator->getConfig('skipTwoFactorVerify');
                        $userData = $result->getData()->toArray();
                        $webauthn2faChecker = $this->getWebauthn2fAuthenticationChecker();
                        if ($skipTwoFactorVerify !== true && $webauthn2faChecker->isRequired($userData)) {
                            return $this->proceedToWebauthn2fa($request, $result);
                        }
            
            
            $u2fCheck = $this->getU2fAuthenticationChecker();
                        if ($skipTwoFactorVerify !== true && $u2fCheck->isRequired($userData)) {

When I then go into the CookieAuthenticator vendor/cakephp/authentication/src/Authenticator/CookieAuthenticator.php there is a call $identity = $this->_identifier->identify(compact('username')); which should return a valid user entity.

github.com

cakephp/authentication/blob/2.x/src/Authenticator/CookieAuthenticator.php#L108

      
        
            }
            
            
if ($token === null || count($token) !== 2) {
                return new Result(null, Result::FAILURE_CREDENTIALS_INVALID, [
                    'Cookie token is invalid.',
                ]);
            }
            
            
[$username, $tokenHash] = $token;
            
            
$identity = $this->_identifier->identify(compact('username'));
            
            
if (empty($identity)) {
                return new Result(null, Result::FAILURE_IDENTITY_NOT_FOUND, $this->_identifier->getErrors());
            }
            
            
if (!$this->_checkToken($identity, $tokenHash)) {
                return new Result(null, Result::FAILURE_CREDENTIALS_INVALID, [
                    'Cookie token does not match',
                ]);
            }

Also $this->_checkToken($identity, $tokenHash) should return true because the given token from the parsed cookie should be valid for the given entity.

github.com

cakephp/authentication/blob/2.x/src/Authenticator/CookieAuthenticator.php#L114

      
        
                }
            
            
    [$username, $tokenHash] = $token;
            
            
    $identity = $this->_identifier->identify(compact('username'));
            
            
    if (empty($identity)) {
                    return new Result(null, Result::FAILURE_IDENTITY_NOT_FOUND, $this->_identifier->getErrors());
                }
            
            
    if (!$this->_checkToken($identity, $tokenHash)) {
                    return new Result(null, Result::FAILURE_CREDENTIALS_INVALID, [
                        'Cookie token does not match',
                    ]);
                }
            
            
    return new Result($identity, Result::SUCCESS);
            }
            
            
/**
             * @inheritDoc

Please check all these functions / return values of these functions and you may get more infos what is missing in your setup.

atlet · March 16, 2022, 2:02pm

Tnx for great reply. I thing I found the problem. In cookie there is missing username (for login I use only email filed and in table I have username as NULL).

Now I need to find solution how to set username filed with email.

KevinPfeifer · March 16, 2022, 2:15pm

Did you do users/Configuration.md at master · CakeDC/users · GitHub?

To be exact: Did you add the following to your config/users.php

'Auth.Identifiers.Password.fields.username' => 'email',
'Auth.Authenticators.Form.fields.username' => 'email',

atlet · March 16, 2022, 2:17pm

Fixed. I just added in users.php

'Auth.Authenticators.Cookie.fields.username' => 'email',

And now it’s working fine. @KevinPfeifer tnx for great help!

KevinPfeifer · March 16, 2022, 2:23pm

That info about email only login would have been a good addition at the start
The default install comes with both username as well as email being a valid “username” field value.

Topic		Replies	Views
CakePHP 4 and Auth Plugin - Remember Me doesn't work Need Help	0	773	January 26, 2021
Remember me cookie cakephp 4 not working Need Help	7	2037	September 5, 2021
Autentication " Remember me" cookie cakephp 4 not working correctly after login	0	380	May 8, 2023
Remember me CookieAuth decryption issues Need Help help	7	456	December 14, 2022
Issues with connexion and UsersController and form Need Help help	7	535	July 29, 2023

Remember me function not working

Releases

Documentation

Community

Remember me function not working

Related topics

Releases

Documentation

Community