Merge pull request #450 from armanist/447-Remember-me-cookie-in-SessionAuthAdapter-missing-httpOnly-and-secure-flags

Remember-me cookie in SessionAuthAdapter missing httpOnly and secure flags

Author: armanist

src/Auth/Adapters/SessionAuthAdapter.php

@@ -40,6 +40,8 @@ class SessionAuthAdapter implements AuthenticatableInterface
 {
     use AuthTrait;
 
+    private const REMEMBER_TOKEN_LIFETIME = 2592000;
+
     /**
      * @throws AuthException
      */
@@ -201,7 +203,15 @@ private function setRememberToken(User $user): void
             [$this->keyFields[AuthKeys::REMEMBER_TOKEN] => $rememberToken]
         );
 
-        cookie()->set($this->keyFields[AuthKeys::REMEMBER_TOKEN], $rememberToken);
+        cookie()->set(
+            $this->keyFields[AuthKeys::REMEMBER_TOKEN],
+            $rememberToken,
+            self::REMEMBER_TOKEN_LIFETIME,
+            '/',
+            '',
+            true,
+            true
+        );
     }
 
     /**

tests/Unit/Auth/Adapters/SessionAuthAdapterTest.php

@@ -63,6 +63,34 @@ public function testWebSigninWithRemember(): void
         $this->assertTrue($this->sessionAuth->check());
     }
 
+    public function testWebSigninWithRememberSetsCookie(): void
+    {
+        $this->assertFalse(cookie()->has('remember_token'));
+
+        $this->sessionAuth->signin('admin@qt.com', 'qwerty', true);
+
+        $this->assertTrue(cookie()->has('remember_token'));
+        $this->assertNotEmpty(cookie()->get('remember_token'));
+    }
+
+    public function testWebSigninWithoutRememberDoesNotSetCookie(): void
+    {
+        $this->sessionAuth->signin('admin@qt.com', 'qwerty');
+
+        $this->assertFalse(cookie()->has('remember_token'));
+    }
+
+    public function testWebSignoutRemovesRememberCookie(): void
+    {
+        $this->sessionAuth->signin('admin@qt.com', 'qwerty', true);
+
+        $this->assertTrue(cookie()->has('remember_token'));
+
+        $this->sessionAuth->signout();
+
+        $this->assertFalse(cookie()->has('remember_token'));
+    }
+
     public function testWebSignout(): void
     {
         $this->assertFalse($this->sessionAuth->check());