Yii 2.0: yii2-remember-me

Enhanced Remember Me
3 followers

When a user requests "Remember Me" during login, a new identity cookie is created for that user for that browser/computer. The cookie contains three things which are also stored in a database table: (1) a Cookie ID, which is the record number in the identity cookie database table, (2) A Cookie Key, which is the "password" for that particular cookie, and (3) A User Key, which is the "password" for the associated user. When I say "password", it is a random string, not an actual password. The database stores some other information, including the User ID number.

Each time a user restarts their browser and is authenticated using this system, all three items are checked against the database. If the contents of the cookie match a record in the database, the user gains access to the system and a new User Key is generated. The new User Key is stored in the database and in the identity cookie.

If a particular user uses three different computers, then there will be three different records in the database, one for each cookie. When each of these cookies is used to authenticate a user, the User Key for that particular cookie is regenerated, leaving the other identity cookie User Keys unchanged. This allows a particular user to have "Remember Me" functionality on multiple computers, yet still have their User Key change with each use.

If someone copies or steals an identity cookie, whichever cookie is used first (the original or the copy) will still work, since there is no way to determine which is the original and which is the copy. The User Key will match and a new User Key will be generated. Once the other cookie is used, the User Key will have already changed. The Cookie ID and Cookie Key will match, but the User Key will not, thus indicating that more than one identity cookies exists with this Cookie ID and Cookie Key. The database record is then deleted, thus disabling all cookies with this Cookie ID and Cookie Key.

Requirements

  • Yii 2.0.10 or above

Installation

Install this extension with composer. Either run

php composer.phar require listfixer/yii2-remember-me

or add

"listfixer/yii2-remember-me": "*"

to the "require" section of your composer.json file.

Usage

To create the database table, use this command from your Yii2 application base directory:

php ./yii migrate --migrationPath=@vendor/listfixer/yii2-remember-me/migrations

The database migration assumes that you have a table called "user" with an integer primary key called "id".

To enable this extension, edit your configuration file to include this component information:

'components' => [
    'user' => [
        'class' => 'listfixer\remember\RememberMe',
        'identityClass' => /* you should already have something here */,
        'enableAutoLogin' => true,
    ]
]

Resources

Total 2 comments

#20043 report it
Kira Rumata at 2017/03/10 11:11pm
I suggest you to redefine migration

I suggest you to redefine migration like https://github.com/yii2tech/authlog - nobody will remember to apply migration NOT from console\migrations during deployment.

#20024 report it
jb_canada at 2017/02/03 11:06pm
Migration did not work with Postgresql.

Simple fix. 'FOREIGN KEY (user_id) REFERENCES user (id) ON DELETE CASCADE ON UPDATE CASCADE'

Change to (the user needs to be "user") 'FOREIGN KEY (user_id) REFERENCES "user" (id) ON DELETE CASCADE ON UPDATE CASCADE'

Leave a comment

Please to leave your comment.

Create extension
Downloads
No downloadable files yet