Chapters

36 Chapters | 1:50:44 |

01

Introduction

0:44
02

Security Fundamentals

3:47
03

Authorization with Access Control

2:08
04

Creating a Login Form (Part 1)

4:46
05

Creating a Login Form (Part 2)

3:57
06

Logging Out and Cleaning Up

5:03
07

Twig Security and IS_AUTHENTICATED_FULLY

2:41
08

Denying Access: AccessDeniedException

4:23
09

Entity Security

4:32
10

Saving Users

3:37
11

Adding Dynamic Roles to each User

4:56
12

Repository Security

4:20
13

Doctrine’s QueryBuilder

2:25
14

The UserProvider: Custom Logic to Load Security Users

3:15
15

User Serialization

2:16
16

Registration Form

3:11
17

Form Rendering

4:38
18

Using More Fields: email and repeated

2:31
19

Handling Form Submissions

4:22
20

Form: Default Data

2:10
21

Cleaning up with a plainPassword Field

1:34
22

Using an External Form Type Class

2:40
23

Registration Validation

3:36
24

Server-Side Validation

4:18
25

Adding a Flash Message

1:35
26

Automatically Authenticating after Registration

0:55
27

Functional Testing

5:04
28

Testing Forms

3:21
29

Controlling Data / Fixtures in a Test

3:23
30

More about Container, the “doctrine” Service and the Entity Manager

1:54
31

After-dinner Mint

3:35
32

Security: Creating Roles and Role Hierarchies

2:50
33

Switching Users / Impersonation

1:09
34

Whitelisting: Securing all Pages, except a few

2:15
35

Accessing the User

1:09
36

Remember Me Functionality

1:44

This tutorial has a new version, check it out!

> Symfony 2 > Starting in Symfony2: Course 2 (2.4+)

Buy Access to Course

36.

Remember Me Functionality

Autoplay

Keep on Learning!

If you liked what you've learned so far, dive in! Subscribe to get
access to this tutorial plus video, code and script downloads.

Start your All-Access Pass

Buy just this tutorial for $12.00

Previous Chapter

Next Course

Remember Me Functionality¶

I want to leave you with just one more tip. We talked a bit about the remember me functionality, but we didn’t actually see how to use it. Activate the feature by adding the remember_me entry to your firewall and giving it a secret, random key:

# app/config/security.yml
security:
    # ...
    firewalls:
        secured_area:
            # ...
            remember_me:
                key: "Order 1138"

Tip

You can also use a secret parameter from parameters.yml as a remember me key to centralize secret key management for the entire application.

Next, open the login template and add a field named _remember_me:

{# src/Yoda/UserBundle/Resources/views/Login/login.html.twig #}
{# ... #}

<form ...>

    <hr/>
    Remember me <input type="checkbox" name="_remember_me" />
    <button type="submit" class="btn btn-primary pull-right">login</button>
</form>

This works a bit like login does: as long as we have a _remember_me checkbox and it’s checked, Symfony will take care of everything automatically.

Try it out! After logging in, we now have a REMEMBERME cookie. Let’s clear our session cookie to make sure it’s working. When I refresh, my session is gone but I’m still logged in. Nice! Click anywhere on the web debug toolbar to get into the profiler. Next, click on the “Logs” tab. If you look closely, you can even see some logs for the remember me login process:

DEBUG - Remember-me cookie detected.
INFO - Remember-me cookie accepted.
DEBUG - SecurityContext populated with remember-me token.

Ok gang, that’s all for now! I hope I’ll see you in future Knp screencasts. And remember to check out KnpBundles.com if you’re curious about all the open source bundles that you can bring into your app. Seeya next time!

9 Comments

Sort By

MolloKhan SFCASTS 5 years ago

Hi, I had a problem in this last step. After login with remember me on, I keep losing my session after deleting Cookie session as shown in the video.

I'm on a virtual machine with ubuntu server and I browse my pages by IP
I'm not sure if this is causing the problem.

Would be nice to hear something about of sharing cookies between subdomains.
Cheers!

| Reply |

weaverryan SFCASTS MolloKhan 5 years ago

Hi Diego!

Hmm, it's definitely not normal behavior, and I'm not sure if the IP address would affect that. I would think it wouldn't, but I also can't explain *why* it's not working for you. It may not help, but if you delete the session cookie, `tail -f app/logs/dev.log`, then refresh, you should see a log message about the remember me cookie. If the remember me cookie is working, you'd see a message like this: "SecurityContext populated with remember-me token.". Again, it might not help - but if you're curious, you can take a look. If you're *really* curious, you can open the core class that handles the remember me cookie (RememberMeListener) and add debug code there. But be warned - the security stuff can be pretty tough :).

Oh, and on your last question - a good one, with fortunately a simple answer. All you'd need to do to share cookies across subdomains is to make sure that the cookie domain is set to something like *.example.com. This can be controlled with the cookie_domain config option: http://symfony.com/doc/curr...

Cheers!

1 | Reply |

MolloKhan SFCASTS weaverryan 5 years ago

Hey Ryan, thanks for your answer!

Was my bad, I had "IS_AUTHENTICATED_FULLY" in my if statement, instead of "IS_AUTHENTICATED_REMEMBERED"

That's a nice and easy way to share cookies!

One more question:
If I have, lets say:
accounts.mydomain.com
stream.mydomain.com
www.mydomain.com

They all are part of the same website, they just serve different purposes.

Do I have to install symfony to every subdomain ? or there is a way to manage them all with only one installation ?

As always, thanks for your time and have a good day

| Reply |

weaverryan SFCASTS MolloKhan 5 years ago

Awesome! For the 3 sites, you have a few options. You could have one app, but then give each route a host requirement, for whatever host you want: http://symfony.com/doc/curr.... You'll actually want to setup some parameters, like is shown about half-way down the page, so that you can have different domains locally (e.g. stream.mydomain.local).

It's more advanced, but you could also setup 3 separate kernels, then have different front controllers for each domain (you'd configure each domain in Apache/Nginx to rewrite through a different file - like app_accounts.php) that boots the different kernels (e.g. AccountKernel, StreamKernel and AppKernel). I don't recommend this, unless you know what you're doing or are *really* concerned about performance (as splitting into 3 apps will be just a little bit faster).

Cheers!

| Reply |

YoyoSan 5 years ago edited

Hello!

The`
remember_me.key`
is deprecated in 2.8.

remember_me.secret```
 should be used instead.

Read more here http://symfony.com/doc/current/cookbook/security/remember_me.html.

| Reply |

weaverryan SFCASTS YoyoSan 5 years ago

Good tip - thanks!

| Reply |

Junaid Farooq 5 years ago

Hi there,

I have a question here. If i dont check the Remember Me checkbox, i will be logged in for the current session means that if i close the browser and then re-open it, i should be logged out as it opens another session to my site. I tried this here, but i was still logged in. Please correct me if i am wrong. I could also see that there is a remember me cookie with a deleted value but if i check the Remember Me checkbox, the rememeber me cookie is set. Also please tell me what is the use of the remember me key that we set in the security.yml config. Thanks in advamce.

Cheers!

| Reply |

MolloKhan SFCASTS Junaid Farooq 5 years ago edited

Hey Junaid Farooq

You are right about the "remember me" functionality, if it's checked, you will be authenticated from the cookie, but, if it's unchecked you will have to provide your credentials every time. Why you could "re-start" your session after closing the browser?Well, that's because you didn't wait enough time to let the server kill your current session. I believe the default time is about 5 minutes (I may be wrong)

> what is the use of the remember me key that we set in the security.yml config
It is for configuring the "remember me" functionality, like setting the life time, specifying a secret value for protecting your cookies, and other things.

I hope it helps you even a bit :)

Cheers!

1 | Reply |

Junaid Farooq MolloKhan 5 years ago edited

Thanks MolloKhan

It does clarify a lot.

Cheers!

4 | Reply |

Symfony 2

What PHP libraries does this tutorial use?

// composer.json
{
    "require": {
        "php": ">=5.3.3",
        "symfony/symfony": "~2.4", // v2.4.2
        "doctrine/orm": "~2.2,>=2.2.3", // v2.4.2
        "doctrine/doctrine-bundle": "~1.2", // v1.2.0
        "twig/extensions": "~1.0", // v1.0.1
        "symfony/assetic-bundle": "~2.3", // v2.3.0
        "symfony/swiftmailer-bundle": "~2.3", // v2.3.5
        "symfony/monolog-bundle": "~2.4", // v2.5.0
        "sensio/distribution-bundle": "~2.3", // v2.3.4
        "sensio/framework-extra-bundle": "~3.0", // v3.0.0
        "sensio/generator-bundle": "~2.3", // v2.3.4
        "incenteev/composer-parameter-handler": "~2.0", // v2.1.0
        "doctrine/doctrine-fixtures-bundle": "~2.2.0", // v2.2.0
        "ircmaxell/password-compat": "~1.0.3", // 1.0.3
        "phpunit/phpunit": "~4.1" // 4.1.0
    }
}

Previous Chapter

Next Course

Remember Me Functionality

Share this awesome video!

Keep on Learning!

Remember Me Functionality¶

9 Comments

Delete comment?

What PHP libraries does this tutorial use?