{"action":"created","issue":{"url":"https://api.github.com/repos/contao/core-bundle/issues/481","repository_url":"https://api.github.com/repos/contao/core-bundle","labels_url":"https://api.github.com/repos/contao/core-bundle/issues/481/labels{/name}","comments_url":"https://api.github.com/repos/contao/core-bundle/issues/481/comments","events_url":"https://api.github.com/repos/contao/core-bundle/issues/481/events","html_url":"https://github.com/contao/core-bundle/pull/481","id":153658756,"number":481,"title":"[RFC] Symfony RememberMe Service Implementation","user":{"login":"DanielSchwiperich","id":2045722,"avatar_url":"https://avatars.githubusercontent.com/u/2045722?v=3","gravatar_id":"","url":"https://api.github.com/users/DanielSchwiperich","html_url":"https://github.com/DanielSchwiperich","followers_url":"https://api.github.com/users/DanielSchwiperich/followers","following_url":"https://api.github.com/users/DanielSchwiperich/following{/other_user}","gists_url":"https://api.github.com/users/DanielSchwiperich/gists{/gist_id}","starred_url":"https://api.github.com/users/DanielSchwiperich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanielSchwiperich/subscriptions","organizations_url":"https://api.github.com/users/DanielSchwiperich/orgs","repos_url":"https://api.github.com/users/DanielSchwiperich/repos","events_url":"https://api.github.com/users/DanielSchwiperich/events{/privacy}","received_events_url":"https://api.github.com/users/DanielSchwiperich/received_events","type":"User","site_admin":false},"labels":[{"id":104721160,"url":"https://api.github.com/repos/contao/core-bundle/labels/feature","name":"feature","color":"3364b7","default":false},{"id":475744158,"url":"https://api.github.com/repos/contao/core-bundle/labels/unresolved%20issues","name":"unresolved issues","color":"fbca04","default":false}],"state":"open","locked":false,"assignee":{"login":"DanielSchwiperich","id":2045722,"avatar_url":"https://avatars.githubusercontent.com/u/2045722?v=3","gravatar_id":"","url":"https://api.github.com/users/DanielSchwiperich","html_url":"https://github.com/DanielSchwiperich","followers_url":"https://api.github.com/users/DanielSchwiperich/followers","following_url":"https://api.github.com/users/DanielSchwiperich/following{/other_user}","gists_url":"https://api.github.com/users/DanielSchwiperich/gists{/gist_id}","starred_url":"https://api.github.com/users/DanielSchwiperich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanielSchwiperich/subscriptions","organizations_url":"https://api.github.com/users/DanielSchwiperich/orgs","repos_url":"https://api.github.com/users/DanielSchwiperich/repos","events_url":"https://api.github.com/users/DanielSchwiperich/events{/privacy}","received_events_url":"https://api.github.com/users/DanielSchwiperich/received_events","type":"User","site_admin":false},"assignees":[{"login":"DanielSchwiperich","id":2045722,"avatar_url":"https://avatars.githubusercontent.com/u/2045722?v=3","gravatar_id":"","url":"https://api.github.com/users/DanielSchwiperich","html_url":"https://github.com/DanielSchwiperich","followers_url":"https://api.github.com/users/DanielSchwiperich/followers","following_url":"https://api.github.com/users/DanielSchwiperich/following{/other_user}","gists_url":"https://api.github.com/users/DanielSchwiperich/gists{/gist_id}","starred_url":"https://api.github.com/users/DanielSchwiperich/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/DanielSchwiperich/subscriptions","organizations_url":"https://api.github.com/users/DanielSchwiperich/orgs","repos_url":"https://api.github.com/users/DanielSchwiperich/repos","events_url":"https://api.github.com/users/DanielSchwiperich/events{/privacy}","received_events_url":"https://api.github.com/users/DanielSchwiperich/received_events","type":"User","site_admin":false}],"milestone":null,"comments":18,"created_at":"2016-05-08T14:28:38Z","updated_at":"2016-11-08T09:02:37Z","closed_at":null,"pull_request":{"url":"https://api.github.com/repos/contao/core-bundle/pulls/481","html_url":"https://github.com/contao/core-bundle/pull/481","diff_url":"https://github.com/contao/core-bundle/pull/481.diff","patch_url":"https://github.com/contao/core-bundle/pull/481.patch"},"body":"This is the PR for Issue #454 \n\nThe current status is completely working but I need Feedback before going further\n## What is this PR for:\n\nProviding autologin functionality across different devices for a frontend user. The current implementation only allows autologin for one device.\n## Questions\n1. **Make the Implementation optional, parallel or replace?** We could add _Allow autologin from multiple devices_ to tl_settings. See https://github.com/contao/core-bundle/issues/454#issuecomment-217706318 for infos on it.  \n   I would vote for optional in combination with parallel for the most user comfort with deprecation warning for Contao 5. (Switching from normal autologin to multi-autologin would not break autologin cookies)\n2. **How to handle the _cookie lifetime_ param?** Since the RememberMeService needs this setting at startup and cannot be changed later I had to put it in the DI Container for now. There the `$GLOBALS['TL_CONFIG']['autologin']` is not available atm. So we either had to \n   - remove it from tl_settings\n   - write it back to the parameters.yml (bad practice?) \n   - load the localconfig.php with default.php (as fallback) in DI / CoreExtension (also bad practice?)\n   - write it to another, dynamic configuration.yml and load in  DI / CoreExtension\n## Further Implementation Infos\n- Currently the rememberMeService lives beside the current autologin implementation (which is no problem, they do not harm each other in any way)\n- The contao.logger you see in the services.yml / logger class is for development. The Symfony rememberMe Service class can _only_ handle a psr-3 compatible logger, so I made a quick wrapper for it. Will be removed \n- I had to extend the Contao UserProvider to make it compatible to the remember service. The current implementation does not allow to really load a user. I'm sure this was done on purpose by @aschempp but don't know why\n- The rememberMeService requires The User Object to implement the `UserInterface`. I moved that part to the `User` class instead of the `FrontendUser`, so this has not to be changed for future auth implementations where the backend is also involved.\n- The authenticate method diff looks bigger than it is. I had to move one part and restructure a little bit to avoid code duplication\n- Code is not very pretty atm. Are there any Code / Style Conventions? Didn't found any info on it\n## How To test\n- Setup a Contao Installation with a login form and autologin enabled\n- Create a member user\n- Login to the frontend\n- Delete the FE_AUTH and FE_AUTOLOGIN cookie, reload the site (currently the rememberMeService uses it's own Cookie FE_AUTOLOGIN_MULTI). See the user should still be logged in. \n## Todos\n- [ ] Write Unittests\n- [x] Implementation of Question 1,2\n- [ ] Code Style\n---\n\n~~I had a to rush a little bit when I was half through the PR, because guests arrived for BQ, but I wanted to get out to you. Will reread that later and _optimize_~~ <- done :smile: \n"},"comment":{"url":"https://api.github.com/repos/contao/core-bundle/issues/comments/259081872","html_url":"https://github.com/contao/core-bundle/pull/481#issuecomment-259081872","issue_url":"https://api.github.com/repos/contao/core-bundle/issues/481","id":259081872,"user":{"login":"leofeyer","id":1192057,"avatar_url":"https://avatars.githubusercontent.com/u/1192057?v=3","gravatar_id":"","url":"https://api.github.com/users/leofeyer","html_url":"https://github.com/leofeyer","followers_url":"https://api.github.com/users/leofeyer/followers","following_url":"https://api.github.com/users/leofeyer/following{/other_user}","gists_url":"https://api.github.com/users/leofeyer/gists{/gist_id}","starred_url":"https://api.github.com/users/leofeyer/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leofeyer/subscriptions","organizations_url":"https://api.github.com/users/leofeyer/orgs","repos_url":"https://api.github.com/users/leofeyer/repos","events_url":"https://api.github.com/users/leofeyer/events{/privacy}","received_events_url":"https://api.github.com/users/leofeyer/received_events","type":"User","site_admin":false},"created_at":"2016-11-08T09:02:37Z","updated_at":"2016-11-08T09:02:37Z","body":"> Instead of using the `TokenBasedRememberMeService` we would need to use the `PersistentTokenBasedRememberMeServices`. That requires a new database table though, and implementation would not be done in a few hours.\r\n\r\nStill I think this is the right way to go. The current implementation is not secure (enough)."}}
{"actor":{"display_login":"leofeyer"}}