Question 331361 in PHP Question posted in
Official manual can be found here.

Php – Remember me function for custom user login in Sulu CMS

I created a website with a user login using Sulu CMF. For the user login, I would like to create a "remember me" checkbox. According to Symfony docs, all that need to be done is

  • adjust firewall settings in security.yaml
  • add a checkbox to the form, with name="_remember_me"
  • add Remember Me Support to the Authenticator

Symfony docs link

The first two points are straight forward. For the third point, "add Remember Me Support to the Authenticator" I am a bit lost, as with sulu I am not using a custom authenticator, but Sulu rather provides the authentication mechanism, with Sulu users and roles an all that.

How can I tell the Sulu authenticator to add the RememberMeBadge to the authentication Passport as described in the docs?

Update:
When loggin in, the server responds with the REMEMBERME cookie, but with the value "deleted".

Tags:

2

Answers


  1. Chosen as BEST ANSWER
    0

    Finally I got it working by creating a custom Authenticator. The reason why it did not work in the first place is due to the symfony FormLoginAuthenticator that creates the RememberMeBadge, but does not enable it. See https://github.com/symfony/security-http/blob/7.0/Authenticator/FormLoginAuthenticator.php

    Here you see that the RememberMeBadge is disabled by default: https://github.com/symfony/security-http/blob/7.0/Authenticator/Passport/Badge/RememberMeBadge.php

    That fact that the badge is created but not enabled, does not make sense to me, maybe this is a bug in the Symfony framework.

    However, a custom Authenticator that creates and enables the badge, solved the issue for me.

    <?php

namespace AppSecurity;

use SymfonyComponentHttpFoundationRedirectResponse;
use SymfonyComponentHttpFoundationRequest;
use SymfonyComponentHttpFoundationResponse;
use SymfonyComponentRoutingGeneratorUrlGeneratorInterface;
use SymfonyComponentSecurityCoreAuthenticationTokenTokenInterface;
use SymfonyComponentSecurityHttpAuthenticatorAbstractLoginFormAuthenticator;
use SymfonyComponentSecurityHttpAuthenticatorPassportBadgeCsrfTokenBadge;
use SymfonyComponentSecurityHttpAuthenticatorPassportBadgeRememberMeBadge;
use SymfonyComponentSecurityHttpAuthenticatorPassportBadgeUserBadge;
use SymfonyComponentSecurityHttpAuthenticatorPassportCredentialsPasswordCredentials;
use SymfonyComponentSecurityHttpAuthenticatorPassportPassport;
use SymfonyComponentSecurityHttpSecurityRequestAttributes;
use SymfonyComponentSecurityHttpUtilTargetPathTrait;

class CustomAuthenticator extends AbstractLoginFormAuthenticator
{
    use TargetPathTrait;

    public const LOGIN_ROUTE = 'app_login';

    public function __construct(private UrlGeneratorInterface $urlGenerator)
    {
    }

    public function authenticate(Request $request): Passport
    {
        $username = $request->request->get('_username', '');

        $request->getSession()->set(SecurityRequestAttributes::LAST_USERNAME, $username);

        return new Passport(
            new UserBadge($username),
            new PasswordCredentials($request->request->get('_password', '')),
            [
                new CsrfTokenBadge('authenticate', $request->request->get('_csrf_token')),
                (new RememberMeBadge())->enable(),
            ]
        );
    }

    public function onAuthenticationSuccess(Request $request, TokenInterface $token, string $firewallName): ?Response
    {
        if ($targetPath = $this->getTargetPath($request->getSession(), $firewallName)) {
            return new RedirectResponse($targetPath);
        }

        // redirect to homepage
        return new RedirectResponse('/');
    }

    protected function getLoginUrl(Request $request): string
    {
        return $this->urlGenerator->generate(self::LOGIN_ROUTE);
    }
}

    The authenticator was created using the symfony cli command php bin/console make:auth with some minor adjustments.


  2. 0

    Remember me should work like expected and the same way like in Symfony. Keep in mind if you want to put Sulu Content Pages or Articles behind a Firewall you need to activate User Context based caching.

    The documentation can be found here:

    https://docs.sulu.io/en/2.5/cookbook/user-context-caching.html

    The login, remember me, … is Symfony default, keep in mind that remember me in Symfony requires cookies and that your server isn’t stripping some cookies away and the remember me cookie is correctly set in your browser. Also special privacy browsers or browser plugins clear cookies from time to time, so it always good to test things also in another browser to make sure its not related to that one.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search