无需记住我令牌的Laravel身份验证

Question

I am using Laravel 4.2's authentication mechanism and I am trying to figure out when and how the "remember me" cookie token gets set.

For some reason when I do the following code, even though the second parameter is false , when I close the browser and reopen it I still get logged in automatically without needing to type in the username and password. So practically it is always acting as if the 'Remember Me' is checked, even if it is false .

My authentication code:

 //called on POST of login page with credentials
 $userdata = array(
            'email'     => Input::get('email'),
            'password'  => Input::get('password')
  );

  // attempt to do the login
  if (Auth::attempt($userdata, false))
  {
         //redirect to main secure page

My check on the login page to check if the user was already authenticated:

  //called on GET of login page
  if (Auth::check())
  {
         //user already logged in, redirect to main secure page immediately

Even though Auth::attempt() is being passed false , the Auth::check() still returns true when I close the browser and reopen it, which normally clears any sessions.

When I used to do authentication manually in PHP (not using Laravel's Authentication method), I used to use something like:

   //authenticate the user with the DB and get the $user object
    $_SESSION['user'] = $user;        //set it in the session

And then in my secure pages I would check if the user is logged in by doing:

    if (isset($_SESSION['user']))
    {
       //user already logged in ...

In this case, closing the browser and reopening it cleared the session. (I just verified this again with one of my older webapps and it still behaves that way, so its not some browser issue).

Is there any reason why Laravel is not behaving in this way? If it is retaining the authentication session across browser sessions anyway, what is the point of passing the 'remember me' flag? Is there a way to disable this behaviour and make it work normally (ie when the browser is closed the session is no longer retained)?

Answer 1

OK seems that apart from the config/auth.php configuration there is a more detailed session configuration in config/session.php , and what I want is actually there in that file.

The setting 'expire_on_close' => false in that file is what is causing this behaviour, and changing it to true immediately solves the issue.

Not sure why its false by default. Its not secure if people just close their browser without logging out of the application (since they wouldn't have checked the 'remember me' flag they would think that the application wouldn't remember them and the session would have been destroyed), and someone else opens the browser and would be able to access the secure pages just the same.

Anyway, posted answer in case someone needs it.