How to Add "Remember Me" Login Functionality

Forcing the User to Opt-Out of the Remember Me Feature

It's a good idea to provide the user with the option to use or not use the remember me functionality, as it will not always be appropriate. The usual way of doing this is to add a checkbox to the login form. By giving the checkbox the name _remember_me (or the name you configured using remember_me_parameter), the cookie will automatically be set when the checkbox is checked and the user successfully logs in. So, your specific login form might ultimately look like this:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

{# app/Resources/views/security/login.html.twig #}
{% if error %}
    <div>{{ error.message }}</div>
{% endif %}

<form action="{{ path('login') }}" method="post">
    <label for="username">Username:</label>
    <input type="text" id="username" name="_username" value="{{ last_username }}"/>

    <label for="password">Password:</label>
    <input type="password" id="password" name="_password"/>

    <input type="checkbox" id="remember_me" name="_remember_me" checked/>
    <label for="remember_me">Keep me logged in</label>

    <input type="submit" name="login"/>
</form>

The user will then automatically be logged in on subsequent visits while the cookie remains valid.

Forcing the User to Re-Authenticate before Accessing certain Resources

When the user returns to your site, they are authenticated automatically based on the information stored in the remember me cookie. This allows the user to access protected resources as if the user had actually authenticated upon visiting the site.

In some cases, however, you may want to force the user to actually re-authenticate before accessing certain resources. For example, you might allow "remember me" users to see basic account information, but then require them to actually re-authenticate before modifying that information.

The Security component provides a way to do this. In addition to roles explicitly assigned to them, users are automatically given one of the following roles depending on how they are authenticated:

IS_AUTHENTICATED_ANONYMOUSLY

Automatically assigned to a user who is in a firewall protected part of the site but who has not actually logged in. This is only possible if anonymous access has been allowed.

IS_AUTHENTICATED_REMEMBERED

Automatically assigned to a user who was authenticated via a remember me cookie.

IS_AUTHENTICATED_FULLY

Automatically assigned to a user that has provided their login details during the current session.

You can use these to control access beyond the explicitly assigned roles.

You can use these additional roles for finer grained control over access to parts of a site. For example, you may want your user to be able to view their account at /account when authenticated by cookie but to have to provide their login details to be able to edit the account details. You can do this by securing specific controller actions using these roles. The edit action in the controller could be secured using the service context.

In the following example, the action is only allowed if the user has the IS_AUTHENTICATED_FULLY role:

1
2
3
4
5
6
7
8
9
10

// ...
use Symfony\Component\Security\Core\Exception\AccessDeniedException;

// ...
public function editAction()
{
    $this->denyAccessUnlessGranted('IS_AUTHENTICATED_FULLY');

    // ...
}

If your application is based on the Symfony Standard Edition, you can also secure your controller using annotations:

1
2
3
4
5
6
7
8
9

use Sensio\Bundle\FrameworkExtraBundle\Configuration\Security;

/**
 * @Security("is_granted('IS_AUTHENTICATED_FULLY')")
 */
public function editAction($name)
{
    // ...
}

For more information on securing services or methods in this way, see How to Secure any Service or Method in your Application.

Storing Remember Me Tokens in the Database

The token contents, including the hashed version of the user password, are stored by default in cookies. If you prefer to store them in a database, use the DoctrineTokenProvider class provided by the Doctrine Bridge.

First, you need to register DoctrineTokenProvider as a service:

1
2
3
4
5

# app/config/services.yml
services:
    # ...

    Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider: ~

1
2
3
4
5
6
7
8
9
10

<!-- app/config/services.xml -->
<?xml version="1.0" encoding="UTF-8" ?>
<container xmlns="http://symfony.com/schema/dic/services"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://symfony.com/schema/dic/services https://symfony.com/schema/dic/services/services-1.0.xsd">

    <services>
        <service id="Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider"/>
    </services>
</container>

1
2
3
4

// app/config/services.php
use Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider;

$container->register(DoctrineTokenProvider::class);

Then you need to create a table with the following structure in your database so DoctrineTokenProvider can store the tokens:

1
2
3
4
5
6
7

CREATE TABLE `rememberme_token` (
    `series`   char(88)     UNIQUE PRIMARY KEY NOT NULL,
    `value`    varchar(88)  NOT NULL,
    `lastUsed` datetime     NOT NULL,
    `class`    varchar(100) NOT NULL,
    `username` varchar(200) NOT NULL
);

1
2
3

doctrine:
    dbal:
        schema_filter: ~^(?!rememberme_token)~

1

<doctrine:dbal schema-filter="~^(?!rememberme_token)~"/>

1
2
3
4
5
6
7

$container->loadFromExtension('doctrine', [
    'dbal' => [
        'schema_filter'  => '~^(?!rememberme_token)~',
        // ...
    ],
    // ...
]);

Finally, set the token_provider option of the remember_me config to the service you just created:

1
2
3
4
5
6
7
8
9
10

# app/config/security.yml
security:
    # ...

    firewalls:
        main:
            # ...
            remember_me:
                # ...
                token_provider: 'Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider'

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

<!-- app/config/security.xml -->
<?xml version="1.0" encoding="UTF-8" ?>
<srv:container xmlns="http://symfony.com/schema/dic/security"
    xmlns:srv="http://symfony.com/schema/dic/services"
    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
    xsi:schemaLocation="http://symfony.com/schema/dic/services
        https://symfony.com/schema/dic/services/services-1.0.xsd">

    <config>
        <!-- ... -->

        <firewall name="main">
            <!-- ... -->

            <remember-me
                token-provider="Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider"
                />
        </firewall>
    </config>
</srv:container>

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

// app/config/security.php
use Symfony\Bridge\Doctrine\Security\RememberMe\DoctrineTokenProvider;

$container->loadFromExtension('security', [
    // ...

    'firewalls' => [
        'main' => [
            // ...
            'remember_me' => [
                // ...
                'token_provider' => DoctrineTokenProvider::class,
            ],
        ],
    ],
]);