Home/ Questions/Q 7439409
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-29T10:42:05+00:00

I have implemented remember me functionality in Symfony2. When I log in with remember

  • 0

I have implemented remember me functionality in Symfony2. When I log in with remember me box checked, cookie named “REMEMBERME” gets created. That cookie is also available if I close browser and open it after many hours. But when I load home page of my application, the cookie gets automatically deleted and I see no user logged in. Can anyone explain me the reason for cookie deletion? 

remember_me:
          key:      qwerty
          lifetime: 604800
          path:     /
          domain:   ~

This is my security.yml file section

EDIT: I have still not found the solution to this question…

EDIT2: Now got new problem. The REMEMBERME cookie does not get set at all. How to solve this??

SOLVED: see answer below

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    John.

    I’ve the same issue as you do (or did), what I’ve found is that when I am (Symfony2 actually =) ) setting REMEMBERME cookie on line 101 at /vendor/symfony/src/Symfony/Component/Security/Http/RememberMe/TokenBasedRememberMeService.php file $user->getPassword() returns NULL, so cookie gets hash calculated with NULL password value.

    What happening next, is when you returning to your site being fully confident that you will be automatically authenticated, Symfony begins to check your cookie at the same file as above but on line 58 it founds that cookie hash is not the same as it expects and throws an exception(‘The cookie\’s hash is invalid.’) internally catches it and proceeds somewhere.

    So that is the case why in my case cookie doesn’t work.

    I haven’t found a solution yet, but I will dig for it and may be I’m lucky.

    Hope your issue is the same and solution will help us both.

    The Solution:

    When implementing eraseCredentials() which claims to be used to erase user sensitive data from UserInterface do not perform $this->password = null. I’ve made this mistake because I haven’t being understanding its purpose. You can take a glance at Symfony 2 Logout (UserInterface::eraseCredentials) for a little bit of explanation. So it serializes token object and we are in trouble.

    • 0