FOSUser - Remember me functionality issue - php

Question

I have built a website with symfony 2.8, I use FOSUserBundle for authentication, user management etc, and I have an issue that I can solve.
For no apparent reason to me, the "rememberme" cookie won't act like as expected.
I pretty sure I've just missed a config parameter in some way but I'm looking for it since hours and can't find it.
I'm using php 7.0 on an apache 2.0 server.
There is my config.yml file (in most part) :
framework:
#esi: ~
translator: { fallbacks: ["%locale%"] }
secret: "%secret%"
router:
resource: "%kernel.root_dir%/config/routing.yml"
strict_requirements: ~
form: ~
csrf_protection: ~
validation: { enable_annotations: true }
#serializer: { enable_annotations: true }
templating:
engines: ['twig']
default_locale: "%locale%"
trusted_hosts: ~
trusted_proxies: ~
session:
# handler_id set to null will use default session handler from php.ini
handler_id: ~
save_path: "%kernel.root_dir%/sessions/"
fragments: ~
http_method_override: true
...
fos_user:
db_driver: orm
firewall_name: main
user_class: UserBundle\Entity\User
from_email:
address: "%email_referer%"
sender_name: "App"
group:
group_class: UserBundle\Entity\Group
group_manager: sonata.user.orm.group_manager
resetting:
email:
template: :mail:resetting_password.html.twig
service:
mailer: fos_user.mailer.twig_swift
user_manager: sonata.user.orm.user_manager
And there is my security.yml :
security:
encoders:
FOS\UserBundle\Model\UserInterface: sha512
role_hierarchy:
ROLE_CHAMPION: [ROLE_USER]
ROLE_ENTREPRISE: [ROLE_USER]
ROLE_ADMIN: [ROLE_USER, ROLE_SONATA_ADMIN, ROLE_A, ROLE_B]
ROLE_SUPER_ADMIN: [ROLE_ADMIN, ROLE_ALLOWED_TO_SWITCH]
SONATA:
- ROLE_SONATA_PAGE_ADMIN_PAGE_EDIT
providers:
fos_userbundle:
id: fos_user.user_manager
firewalls:
admin:
pattern: ^/admin
context: user
form_login:
provider: fos_userbundle
login_path: login
use_forward: true
check_path: sonata_user_admin_security_check
failure_path: null
default_target_path: sonata_admin_dashboard
logout:
path: sonata_user_admin_security_logout
target: homepage
invalidate_session: false
anonymous: true
# disables authentication for assets and the profiler, adapt it according to your needs
dev:
pattern: ^/(_(profiler|wdt)|css|images|js)/
security: false
main:
pattern: .*
context: user
form_login:
provider: fos_userbundle
login_path: login
use_forward: false
check_path: /login_check
failure_path: null
csrf_token_generator: security.csrf.token_manager
default_target_path: profile
logout:
path: logout
target: homepage
invalidate_session: false
anonymous: true
remember_me:
secret: '%secret%'
lifetime: 15724800 # 6 months
path: /
domain: ~
secure: true
access_control:
# Some public pages
- { path: ^/$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/cgu$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/cgv$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/contact$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/faq$, role: IS_AUTHENTICATED_ANONYMOUSLY }
# URL of FOSUserBundle which need to be available to anonymous users
- { path: ^/connexion, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/login, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/register, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
# Admin login page needs to be accessed without credential
- { path: ^/admin/login$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/logout$, role: IS_AUTHENTICATED_ANONYMOUSLY }
- { path: ^/admin/login_check$, role: IS_AUTHENTICATED_ANONYMOUSLY }
# - { path: ^/admin/resetting, role: IS_AUTHENTICATED_ANONYMOUSLY }
# Admin
- { path: ^/admin/, role: [ROLE_ADMIN, ROLE_SONATA_ADMIN] }
# Partie connectée
- { path: ^/, role: IS_AUTHENTICATED_REMEMBERED }
acl:
connection: default
EDIT:
I did some tests and it appears that my REMEMBERME cookie is not deleted, its still here, with the same startdate and enddate than before.
So, I can close and open my browser, the cookie is still here and when I do this I'm still authenticated (and can go to the admin). But when I just stay "idle" for a period of time and I want to access to the admin section, I'm redirected to the login page.
The REMEMBERME cookie still exists, but at this point, I can't access to the page I could when I was starting my browser.
EDIT 2 :
It appears the session lifetime is the "cause" of my problems. But what I want is that when a user check "Remember me" option he has no longer need to login again, even if he keep a tab of my site open for x days in background (like a mobile browser do). How can I do that ?
EDIT 16/08/2017 :
I've added a line in my security.yml file :
domain: ~
It appears that this line make the system work. The issue is no longer detected on my computer with Chrome and Firefox (in case one of these two was playing with my cookies).
PS : I will update this ticket in some days, to "validate" it, if the problem don't show up again.

Answer 1

I think you are talking about your session lifetime more than remember me feature.
In your config.yml you can configure the framework to use a custom session lifetime.
framework:
session:
cookie_lifetime: 3600
If this configuration is not set, the value from your php.ini will be used.
Hope it helps.

Answer 2

The issue no longer appears, the solution seems to be the "domain" parameter :
domain: ~