diff --git a/src/Authentication/Authenticators/Session.php b/src/Authentication/Authenticators/Session.php index 1349c3761..59ef3ead1 100644 --- a/src/Authentication/Authenticators/Session.php +++ b/src/Authentication/Authenticators/Session.php @@ -495,9 +495,12 @@ private function checkRememberMe(): bool private function getRememberMeToken(): ?string { - helper('cookie'); + /** @var IncomingRequest $request */ + $request = service('request'); - return get_cookie('remember'); + $cookieName = setting('Cookie.prefix') . setting('Auth.sessionConfig')['rememberCookieName']; + + return $request->getCookie($cookieName); } /** @@ -627,8 +630,16 @@ private function issueRememberMeToken(): void // Reset so it doesn't mess up future calls. $this->shouldRemember = false; } elseif ($this->getRememberMeToken()) { + /** @var Response $response */ + $response = service('response'); + // Remove incoming remember-me token - delete_cookie(setting('Auth.sessionConfig')['rememberCookieName']); + $response->deleteCookie( + setting('Auth.sessionConfig')['rememberCookieName'], + setting('Cookie.domain'), + setting('Cookie.path'), + setting('Cookie.prefix') + ); // @TODO delete the token record. } diff --git a/tests/Authentication/Authenticators/SessionAuthenticatorTest.php b/tests/Authentication/Authenticators/SessionAuthenticatorTest.php index 4201a7ab9..08f7f2f2b 100644 --- a/tests/Authentication/Authenticators/SessionAuthenticatorTest.php +++ b/tests/Authentication/Authenticators/SessionAuthenticatorTest.php @@ -65,6 +65,9 @@ public function testLoggedInTrue(): void public function testLoggedInWithRememberCookie(): void { unset($_SESSION['user']); + // Set Cookie.prefix + $cookiePrefix = 'prefix_'; + setting('Cookie.prefix', $cookiePrefix); $this->user->createEmailIdentity(['email' => 'foo@example.com', 'password' => 'secret']); @@ -77,8 +80,9 @@ public function testLoggedInWithRememberCookie(): void $rememberModel->rememberUser($this->user, $selector, hash('sha256', $validator), $expires); // Set Cookie value for remember-me. - $token = $selector . ':' . $validator; - $_COOKIE['remember'] = $token; + $token = $selector . ':' . $validator; + $cookieName = $cookiePrefix . setting('Auth.sessionConfig')['rememberCookieName']; + $_COOKIE[$cookieName] = $token; $this->assertTrue($this->auth->loggedIn()); @@ -86,6 +90,9 @@ public function testLoggedInWithRememberCookie(): void $this->assertInstanceOf(User::class, $authUser); $this->assertSame($this->user->id, $authUser->id); + + // Forget Cookie.prefix + setting()->forget('Cookie.prefix'); } public function testLoginNoRemember(): void