[NEW FEATURE] keep-me-logged-in feature about huge

[jeykon]

For what? Activation, password change, come back?

[panique]

Ah sorry, this is really a strange ticket. There should be a "remember me" checkbox on the login form that allows auto-login/permanently being logged in. Some links:

http://stackoverflow.com/questions/1354999/keep-me-logged-in-the-best-approach

http://stackoverflow.com/questions/1074831/remember-me-on-this-computer-how-should-it-work

http://stackoverflow.com/questions/2594960/best-practice-to-implement-secure-remember-me

[panique]

Notice: The user should be able to be logged in even when using the site/application on different computers (home + work or mobile+tablet+desktop etc.)

[blak3r]

Just curious if this was in progress already. Sorry if i missed anything in commit log / issues. I searched first.

[panique]

@blak3r Hey, i've not touched this yet, but my plans are to do this within the next few days.

[blak3r]

@panique cool thanks for the update.

[panique]

NOTE: best tutorial so far, by ircmaxwell, who has written the PHP 5.5 password hashing functions:
“Keep Me Logged In” - the best approach

[panique]

This feature has just been pushed into the develop branch ;)

Currently it's in 4-full-mvc-framework only. In general, all features should be available for 2- and 4- versions, but I simply don't have the time to do so. As PHP's session garbage collector is a tricky thing, I also have written a short guideline on that in the readme file. Gentlemen, have fun testing this ;)

Btw for testing I can recommend using these session settings in the php.ini: This means a session will live for 10 seconds, and every request to the app will trigger the garbage collector with a probability of 1/1 (which is "100%").

session.gc_maxlifetime = 10 // 10 seconds
session.gc_probability = 1
session.gc_divisor = 1

Update: While testing it's good to use 2 browsers at the same time, so 1 browser can reproduce a users behaviour while the other can trigger the gargabe collector.

Deep information on that topic in this really cool thread: How do I expire a PHP session after 30 minutes?.