CakePHP 4如何根据「记住我」复选框动态修改session.cookie_lifetime

Hey there! I totally get the frustration of digging through docs and not finding exactly what you need. Let's sort out this session lifetime issue for your login flow.

The Problem #

Your default session cookie lifetime is set to 2 hours (7200 seconds) in config/app.php, and you want to extend it to 48 hours when the user checks the "remember me" checkbox during login.

The Solution #

When authentication is valid and the user has checked the checkbox, you need to update the session's cookie lifetime and renew the session to apply the new settings. Here's how to modify your LoginController code:

public function index() {
    $this->viewBuilder()->setLayout('main');
    $this->set("title", "");
    $this->set("description", "description");
    $this->request->allowMethod(['get', 'post']);
    $result = $this->Authentication->getResult();
    
    // regardless of POST or GET, redirect if user is logged in
    if ($result->isValid()) {
        if ($this->request->getData('remember') == 'on') {
            // Set cookie lifetime to 48 hours (172800 seconds = 48*60*60)
            ini_set('session.cookie_lifetime', 172800);
            // Renew the session to generate a new cookie with the updated lifetime
            $this->request->getSession()->renew();
        }
        
        $redirect = [
            'controller' => 'Main',
            'action' => 'index',
        ];
        return $this->redirect($redirect);
    }
    
    // display error if user submitted and authentication failed
    if ($this->request->is('post') && !$result->isValid()) {
        $this->Flash->saved_error(__('Invalid email or password'));
    }
}

Why This Works #

1. ini_set('session.cookie_lifetime', 172800): This overrides the default 7200-second setting from config/app.php for the current session context.
2. $this->request->getSession()->renew(): The initial session cookie was created with the default lifetime when authentication succeeded. Calling renew() generates a new session ID and sends a new cookie to the browser with the updated 48-hour expiration time.

Important Notes #

• Make sure your HTML form's checkbox has the name="remember" attribute (it uses on as the default value when checked, which matches your code check).
• This approach works perfectly with your current php session default. If you switch to a different session store (like Redis or database) later, you might need to adjust the method, but it's ideal for your setup right now.

内容的提问来源于stack exchange，提问作者Andrii Tomkiv