为什么RememberMe在Symfony2中无法正常工作？

Question

I have used the key “remember_me” in my file “ security.yml ”, in order to use the remember_me functionality of Symfony. I have used a lifetime of a week (please see my security.yml file below) . I am using Symfony version 2.8.48 and friendsofsymfony/user-bundle versionv 2.0.1.

So after I successfully login to my website through my login form, the REMEMBERME cookie is perfectly set and I can see it on my navigator (google Chrome), with the Expires / Max-Age being correctly set for a week later (on the screenshot, expires at Novembre 7th since the login has been made on Octobre 31st).

But around one or two hours after closing the tab of my website page, if I come back to my website, although the REMEMBERME cookie still appears on my navigator, I am already disconnected .

How is that possible? Why does the remember_me functionality does not work? I followed the exact set-up on the Symfony documentation with the following link:

https://symfony.com/doc/2.8/security/remember_me.html

In my login form, I have also added the input with name remember_me, in the form of a checkbox (check my snippet below)

Is it a problem related to the session parameter in my file config.yml? Is it related to the cookie_lifetime parameter?

Plus, if I want to investigate, where should I start. Where is the information “check if there is a remember_me cookie” triggered in Symfony and what handler automatically checks if there is a remember_me cookie ?

Thank you in advance.

My security.yml file

main_firewall:
        pattern: ^/
        anonymous: false
        context: general_context
        entry_point: my_custom_authentication_entry_point
        form_login:
            provider: fos_userbundle
            login_path: fos_user_security_login
            check_path: fos_user_security_check
            default_target_path: my_custom_target_path
            use_forward: false
            use_referer: true
            post_only: true
            username_parameter: _username
            password_parameter: _password
            success_handler: my_custom_handler
            failure_handler: my_custom_handler
            require_previous_session: false
            csrf_token_generator: security.csrf.token_manager
        logout: true
        remember_me:
            secret: '%secret%'
            lifetime: 604800
            path: /
            always_remember_me: true

My config.yml file (only the session part):

framework:
    session:
        # handler_id set to null will use default session handler from php.ini
        handler_id:  ~

My login.html.twig (simplified version for the purpose of this question):

<form action="{{ path("fos_user_security_check") }}" method="post">
    <h2>{{ 'login.label.email'|trans }}</h2>
    <input id="email" type="email" name="_username" placeholder="{{ 'login.placeholder.email'|trans }}">

    <h2>{{ 'login.label.password'|trans }}</h2>
    <input id="password" class="AS-new-form-input AS-new-form-input-full-width" type="password" name="_password" placeholder="{{ 'login.placeholder.password'|trans }}">

    <div class="hidden">
        <input type="checkbox" id="remember_me" name="_remember_me" checked />
        <label for="remember_me">{{ 'login.label.remember_me'|trans }}</label>
    </div>

    <input type="hidden" name="_csrf_token" value="{{ csrf_token('authenticate') }}"/>
    <button type="submit">{{ 'login.action.connect'|trans }}</button>
</form>

A last small precision, my login form is handled with ajax. So I use the following to submit the login form

var username = ///I get the value from my input
var password = ///I get the value from my input
var csrfToken = ///I get the value from my input

$.ajax({
        url: Routing.generate('login_check'),
        type: 'POST',
        data: {_username: username,_password: password ,_csrf_token: csrfToken, _remember_me: true},
        success: function(data, statusText, xhr) {
            ///execute my function////
        }
    });

Please find also the screenshot of my navigator console below

Extra Information Based on The FIrst Answers

So based on the first comment I got from Jovan, I updated the parameter session.cookie_lifetime and set it to 604800

session:
    cookie_lifetime: 604800

The difference now is that the PHPSESSID cookie has the correct expiry date (show by screenshot below) => I connected my user on November 1st and Expiry date is November 8th.

Although it took me longer to get disconnected, I still get disconnected a few hours after closing my tab (with the cookie lifetime around 5 hours to get disconnected, without it, it took 1 or 2 hours).

I also tried to var_dump ini_get('session.gc_maxlifetime'); and I get 1440.

Do you think it is related to the session lifetime on the server side? Should I update the session.gc_maxlifetime parameter?? Should I update the php.ini file on the server side??

Any ides of other reasons why I keep getting disconnected?

Answer 1

The cookie REMEMBERME does seem valid, but looking into PHPSESSID reveals that it went full circle or went backwards in terms of expiry date. In any case, your cookie is being issued with with already expired date.

So, you can either set the session cookie timeout in you php.ini or in your Symfony config. I prefer the later:

symfony.com > Session Cookie Lifetime

The cookie_lifetime setting is the number of seconds the cookie should live for, it is not a Unix timestamp. The resulting session cookie will be stamped with an expiry time of time() + cookie_lifetime where the time is taken from the server.

According to above, please note that cookie_lifetime is relative value .

Hope this helps a bit...

Answer 2

So I managed to solve my problem in the end.

I made two changes.

The first one: I changed the save_path of my user session, thanks to the parameter framework.session.save_path in the file config.yml. I changed it to a path within my symfony repository instead of having "/home/my-user-name/admin/tmp" on my shared server..

The second one: I modified the php.ini file on my shared server, and updated the session.gc_maxlifetime to 604800.

I don't know which one of these two changes made it work, but it is working fine now.