Problem with remember me button on mobile devices - php

Question

I have made easy login system according to one article on web. If I click remember me button it stores these data (member_login, random_password, random_selector) in cookies on device, where I am logged in. First I used it just on PC.
Later I added IP address verificaction step to enable login on more devíces in same time due to I want to use my app also on mobile device.
Login system is working correctly on PC - there I can be logged in one month if I choose remember me during login.
On mobile devices, on every browser it randomly log out me after some random period.
I already checked if cookies are created on mobile and it is ok.
I could not find rootcause why. Can you please advice me what to check.
Here is my login code, where cookies are setted up:
<?php
require_once ($_SERVER['DOCUMENT_ROOT'] . '/_inc/functions.php');
require_once ($_SERVER['DOCUMENT_ROOT'] . '/_inc/auth/Util.php');
require_once ($_SERVER['DOCUMENT_ROOT'] . '/_inc/auth/Auth.php');
$auth = new Auth();
$db_handle = new DBController();
$util = new Util();
// Get Current date, time
$current_time = time();
$current_date = date("Y-m-d H:i:s", $current_time);
// Set Cookie expiration for 1 month (seconds from 1970 until current date + 1 month)
$cookie_expiration_time = $current_time + (30 * 24 * 60 * 60); // for 1 month
// Auth.php chcek if user is loggedin
if ($_SESSION["user_id"]) {
redirect_page("index.php");
exit;
}
// check if login form was submitted
if (! empty($_POST['login'])) {
$isAuthenticated = false;
// get username and password from form
$username = $_POST['username'];
$password = $_POST['password'];
// get user from db
$user = $auth->getMemberByUsername($username);
// verify entered password with hashed password in db for user got above
if (password_verify($password, $user[0]["password"])) {
$isAuthenticated = true; // password is verified, next rocess of login can start
}
// if user is authenticated start to create cookies
if ($isAuthenticated) {
$_SESSION["user_id"] = $user[0]["id"];
// Set Auth Cookies if 'Remember Me' checked
if (! empty($_POST["remember"])) {
$ip_address = $_SERVER['REMOTE_ADDR'];
// setcookie(string $name, string $value = "", int $expires = 0,)
setcookie("member_login", $username, $cookie_expiration_time, '/'); // '/' cookies are available on each page
$random_password = $util->getToken(16); // create token for cookie identification with db
setcookie("random_password", $random_password, $cookie_expiration_time, '/'); // '/' cookies are available on each page
$random_selector = $util->getToken(32);
setcookie("random_selector", $random_selector, $cookie_expiration_time, '/'); // '/' cookies are available on each page
// hash password and selector before inserting to db
$random_password_hash = password_hash($random_password, PASSWORD_DEFAULT);
$random_selector_hash = password_hash($random_selector, PASSWORD_DEFAULT);
$expiry_date = date("Y-m-d H:i:s", $cookie_expiration_time);
// mark existing token as expired if new login
$userToken = $auth->getTokenByUsername($username, 0);
/*
if (! empty($userToken[0]["id"])) {
$auth->markAsExpired($userToken[0]["id"]);
}
*/
// Insert new token
$auth->insertToken($username, $ip_address, $random_password_hash, $random_selector_hash, $expiry_date);
} else {
$util->clearAuthCookie();
}
redirect_page("index.php");
exit;
} else {
$_SESSION['login_error'] = 'Invalid password or username';
redirect_page("back");
exit();
}
}
Hrere is my validation code to check cookies on each page:
<?php
/* FLow:
-> index -> header -> validatecookies ()
-> continue index (logedin = true)
-> redirect login
*/
require 'Util.php';
require 'Auth.php';
// create objects
$auth = new Auth();
$db_handle = new DBController();
$util = new Util();
$isLoggedIn = false;
// Check if loggedin session and redirect if session exists
if (! empty($_SESSION["user_id"])) {
$isLoggedIn = true;
}
// Check if loggedin cookies exists
else if (! empty($_COOKIE["member_login"]) && ! empty($_COOKIE["random_password"]) && ! empty($_COOKIE["random_selector"])) {
// Initiate auth token verification directive to false
$isPasswordVerified = false;
$isSelectorVerified = false;
$isExpiryDateVerified = false;
// Get token for username from db
$userToken = $auth->getTokenByIPaddress($_SERVER['REMOTE_ADDR'],0);
// $userToken = $auth->getTokenByUsername($_COOKIE["member_login"],0);
if ($userToken) {
// check just in case of the same IP address
// dual control via selector and password due to time leake secure issue (if just one token than according to response time from db it is possible to guess password easier)
// Validate random password cookie with database
if (password_verify($_COOKIE["random_password"], $userToken[0]["password_hash"])) {
$isPasswordVerified = true;
}
// Validate random selector cookie with database
if (password_verify($_COOKIE["random_selector"], $userToken[0]["selector_hash"])) {
$isSelectorVerified = true;
}
// check cookie expiration by date
if( ($userToken[0]["expiry_date"] >= $current_date) & ($userToken[0]["is_expired"] != 1) ) {
$isExpiryDateVerified = true;
}
}
// Redirect if all cookie based validation returns true
// Else, mark the token as expired and clear cookies
if (!empty($userToken[0]["id"]) && $isPasswordVerified && $isSelectorVerified && $isExpiryDateVerified) {
$isLoggedIn = true;
} else {
if(!empty($userToken[0]["id"])) {
$auth->markAsExpired($userToken[0]["id"]);
}
// clear cookies
$util->clearAuthCookie();
header ("Location: login.php");
exit;
}
} else {
// is no session and no cookies exist, just redirect on login
header ("Location: login.php");
exit;
}
?>
``