Skip to content

[Security] Secret with remember me feature #20415

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 27, 2024
Merged

[Security] Secret with remember me feature #20415

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
25 changes: 10 additions & 15 deletions security/remember_me.rst
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ the session lasts using a cookie with the ``remember_me`` firewall option:
main:
# ...
remember_me:
secret: '%kernel.secret%' # required
secret: '%kernel.secret%'
lifetime: 604800 # 1 week in seconds
# by default, the feature is enabled by checking a
# checkbox in the login form (see below), uncomment the
Expand All @@ -44,7 +44,7 @@ the session lasts using a cookie with the ``remember_me`` firewall option:
<firewall name="main">
<!-- ... -->

<!-- secret: required
<!-- secret: default to "%kernel.secret%"
lifetime: 604800 is 1 week in seconds -->
<remember-me
secret="%kernel.secret%"
Expand All @@ -67,7 +67,7 @@ the session lasts using a cookie with the ``remember_me`` firewall option:
$security->firewall('main')
// ...
->rememberMe()
->secret('%kernel.secret%') // required
->secret('%kernel.secret%')
->lifetime(604800) // 1 week in seconds

// by default, the feature is enabled by checking a
Expand All @@ -77,9 +77,11 @@ the session lasts using a cookie with the ``remember_me`` firewall option:
;
};

The ``secret`` option is the only required option and it is used to sign
the remember me cookie. It's common to use the ``kernel.secret`` parameter,
which is defined using the ``APP_SECRET`` environment variable.
.. versionadded:: 7.2

The ``secret`` option is no longer required starting from Symfony 7.2. By
default, ``%kernel.secret%`` is used, which is defined using the
``APP_SECRET`` environment variable.

After enabling the ``remember_me`` system in the configuration, there are a
couple more things to do before remember me works correctly:
Expand Down Expand Up @@ -171,7 +173,6 @@ allow users to opt-out. In these cases, you can use the
main:
# ...
remember_me:
secret: '%kernel.secret%'
# ...
always_remember_me: true

Expand All @@ -194,7 +195,6 @@ allow users to opt-out. In these cases, you can use the
<!-- ... -->

<remember-me
secret="%kernel.secret%"
always-remember-me="true"
/>
</firewall>
Expand All @@ -211,7 +211,6 @@ allow users to opt-out. In these cases, you can use the
$security->firewall('main')
// ...
->rememberMe()
->secret('%kernel.secret%')
// ...
->alwaysRememberMe(true)
;
Expand Down Expand Up @@ -335,7 +334,6 @@ are fetched from the user object using the
main:
# ...
remember_me:
secret: '%kernel.secret%'
# ...
signature_properties: ['password', 'updatedAt']

Expand All @@ -357,7 +355,7 @@ are fetched from the user object using the
<firewall name="main">
<!-- ... -->

<remember-me secret="%kernel.secret%">
<remember-me>
<signature-property>password</signature-property>
<signature-property>updatedAt</signature-property>
</remember-me>
Expand All @@ -375,7 +373,6 @@ are fetched from the user object using the
$security->firewall('main')
// ...
->rememberMe()
->secret('%kernel.secret%')
// ...
->signatureProperties(['password', 'updatedAt'])
;
Expand Down Expand Up @@ -419,7 +416,6 @@ You can enable the doctrine token provider using the ``doctrine`` setting:
main:
# ...
remember_me:
secret: '%kernel.secret%'
# ...
token_provider:
doctrine: true
Expand All @@ -442,7 +438,7 @@ You can enable the doctrine token provider using the ``doctrine`` setting:
<firewall name="main">
<!-- ... -->

<remember-me secret="%kernel.secret%">
<remember-me>
<token-provider doctrine="true"/>
</remember-me>
</firewall>
Expand All @@ -459,7 +455,6 @@ You can enable the doctrine token provider using the ``doctrine`` setting:
$security->firewall('main')
// ...
->rememberMe()
->secret('%kernel.secret%')
// ...
->tokenProvider([
'doctrine' => true,
Expand Down