How to Add "Remember Me" Login Functionality

Once a user is authenticated, their credentials are typically stored in the session. This means that when the session ends they will be logged out and have to provide their login details again next time they wish to access the application. You can allow users to choose to stay logged in for longer than the session lasts using a cookie with the remember_me firewall option:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

# app/config/security.yml
security:
    # ...

    firewalls:
        main:
            # ...
            remember_me:
                secret:   '%secret%'
                lifetime: 604800 # 1 week in seconds
                path:     /
                # by default, the feature is enabled by checking a
                # checkbox in the login form (see below), uncomment the
                # following line to always enable it.
                #always_remember_me: true

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

<!-- app/config/security.xml -->
<?xml version="1.0" encoding="utf-8" ?>
<srv:container xmlns="http://symfony.com/schema/dic/security"
    xmlns:srv="http://symfony.com/schema/dic/services"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://symfony.com/schema/dic/services
        http://symfony.com/schema/dic/services/services-1.0.xsd">

    <config>
        <!-- ... -->

        <firewall name="main">
            <!-- ... -->

            <!-- 604800 is 1 week in seconds -->
            <remember-me
                secret="%secret%"
                lifetime="604800"
                path="/" />
            <!-- by default, the feature is enabled by checking a checkbox
                 in the login form (see below), add always-remember-me="true"
                 to always enable it. -->
        </firewall>
    </config>
</srv:container>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

// app/config/security.php
$container->loadFromExtension('security', array(
    // ...

    'firewalls' => array(
        'main' => array(
            // ...
            'remember_me' => array(
                'secret'   => '%secret%',
                'lifetime' => 604800, // 1 week in seconds
                'path'     => '/',
                // by default, the feature is enabled by checking a
                // checkbox in the login form (see below), uncomment
                // the following line to always enable it.
                //'always_remember_me' => true,
            ),
        ),
    ),
));

The remember_me firewall defines the following configuration options:

secret (required)

2.8

The secret option was introduced in Symfony 2.8. Prior to 2.8, it was named key.

The value used to encrypt the cookie's content. It's common to use the secret value defined in the app/config/parameters.yml file.

name (default value: REMEMBERME)

The name of the cookie used to keep the user logged in. If you enable the remember_me feature in several firewalls of the same application, make sure to choose a different name for the cookie of each firewall. Otherwise, you'll face lots of security related problems.

lifetime (default value: 31536000)

The number of seconds during which the user will remain logged in. By default users are logged in for one year.

path (default value: /)

The path where the cookie associated with this feature is used. By default the cookie will be applied to the entire website but you can restrict to a specific section (e.g. /forum, /admin).

domain (default value: null)

The domain where the cookie associated with this feature is used. By default cookies use the current domain obtained from $_SERVER.

secure (default value: false)

If true, the cookie associated with this feature is sent to the user through an HTTPS secure connection.

httponly (default value: true)

If true, the cookie associated with this feature is accessible only through the HTTP protocol. This means that the cookie won't be accessible by scripting languages, such as JavaScript.

remember_me_parameter (default value: _remember_me)

The name of the form field checked to decide if the "Remember Me" feature should be enabled or not. Keep reading this article to know how to enable this feature conditionally.

always_remember_me (default value: false)

If true, the value of the remember_me_parameter is ignored and the "Remember Me" feature is always enabled, regardless of the desire of the end user.

token_provider (default value: null)

Defines the service id of a token provider to use. By default, tokens are stored in a cookie. For example, you might want to store the token in a database, to not have a (hashed) version of the password in a cookie. The DoctrineBridge comes with a Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider that you can use.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

{# app/Resources/views/security/login.html.twig #}
{% if error %}
    <div>{{ error.message }}</div>
{% endif %}

<form action="{{ path('login') }}" method="post">
    <label for="username">Username:</label>
    <input type="text" id="username" name="_username" value="{{ last_username }}" />

    <label for="password">Password:</label>
    <input type="password" id="password" name="_password" />

    <input type="checkbox" id="remember_me" name="_remember_me" checked />
    <label for="remember_me">Keep me logged in</label>

    <input type="submit" name="login" />
</form>

1
2
3
4
5
6
7
8
9
10

// ...
use Symfony\Component\Security\Core\Exception\AccessDeniedException;

// ...
public function editAction()
{
    $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY');

    // ...
}

1
2
3
4
5
6
7
8
9

use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;

/**
 * @Security("is_granted('IS_AUTHENTICATED_FULLY')")
 */
public function editAction($name)
{
    // ...
}