Skip to content

Commit 63c7f76

Browse files
committed
minor #20415 [Security] Secret with remember me feature (MrYamous)
This PR was squashed before being merged into the 7.2 branch. Discussion ---------- [Security] Secret with remember me feature Following [blog post](https://symfony.com/blog/new-in-symfony-7-2-optional-secret) Commits ------- e427a6c [Security] Secret with remember me feature
2 parents 8147046 + e427a6c commit 63c7f76

File tree

1 file changed

+10
-15
lines changed

1 file changed

+10
-15
lines changed

security/remember_me.rst

Lines changed: 10 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@ the session lasts using a cookie with the ``remember_me`` firewall option:
1919
main:
2020
# ...
2121
remember_me:
22-
secret: '%kernel.secret%' # required
22+
secret: '%kernel.secret%'
2323
lifetime: 604800 # 1 week in seconds
2424
# by default, the feature is enabled by checking a
2525
# checkbox in the login form (see below), uncomment the
@@ -44,7 +44,7 @@ the session lasts using a cookie with the ``remember_me`` firewall option:
4444
<firewall name="main">
4545
<!-- ... -->
4646
47-
<!-- secret: required
47+
<!-- secret: default to "%kernel.secret%"
4848
lifetime: 604800 is 1 week in seconds -->
4949
<remember-me
5050
secret="%kernel.secret%"
@@ -67,7 +67,7 @@ the session lasts using a cookie with the ``remember_me`` firewall option:
6767
$security->firewall('main')
6868
// ...
6969
->rememberMe()
70-
->secret('%kernel.secret%') // required
70+
->secret('%kernel.secret%')
7171
->lifetime(604800) // 1 week in seconds
7272
7373
// by default, the feature is enabled by checking a
@@ -77,9 +77,11 @@ the session lasts using a cookie with the ``remember_me`` firewall option:
7777
;
7878
};
7979
80-
The ``secret`` option is the only required option and it is used to sign
81-
the remember me cookie. It's common to use the ``kernel.secret`` parameter,
82-
which is defined using the ``APP_SECRET`` environment variable.
80+
.. versionadded:: 7.2
81+
82+
The ``secret`` option is no longer required starting from Symfony 7.2. By
83+
default, ``%kernel.secret%`` is used, which is defined using the
84+
``APP_SECRET`` environment variable.
8385

8486
After enabling the ``remember_me`` system in the configuration, there are a
8587
couple more things to do before remember me works correctly:
@@ -171,7 +173,6 @@ allow users to opt-out. In these cases, you can use the
171173
main:
172174
# ...
173175
remember_me:
174-
secret: '%kernel.secret%'
175176
# ...
176177
always_remember_me: true
177178
@@ -194,7 +195,6 @@ allow users to opt-out. In these cases, you can use the
194195
<!-- ... -->
195196
196197
<remember-me
197-
secret="%kernel.secret%"
198198
always-remember-me="true"
199199
/>
200200
</firewall>
@@ -211,7 +211,6 @@ allow users to opt-out. In these cases, you can use the
211211
$security->firewall('main')
212212
// ...
213213
->rememberMe()
214-
->secret('%kernel.secret%')
215214
// ...
216215
->alwaysRememberMe(true)
217216
;
@@ -335,7 +334,6 @@ are fetched from the user object using the
335334
main:
336335
# ...
337336
remember_me:
338-
secret: '%kernel.secret%'
339337
# ...
340338
signature_properties: ['password', 'updatedAt']
341339
@@ -357,7 +355,7 @@ are fetched from the user object using the
357355
<firewall name="main">
358356
<!-- ... -->
359357
360-
<remember-me secret="%kernel.secret%">
358+
<remember-me>
361359
<signature-property>password</signature-property>
362360
<signature-property>updatedAt</signature-property>
363361
</remember-me>
@@ -375,7 +373,6 @@ are fetched from the user object using the
375373
$security->firewall('main')
376374
// ...
377375
->rememberMe()
378-
->secret('%kernel.secret%')
379376
// ...
380377
->signatureProperties(['password', 'updatedAt'])
381378
;
@@ -419,7 +416,6 @@ You can enable the doctrine token provider using the ``doctrine`` setting:
419416
main:
420417
# ...
421418
remember_me:
422-
secret: '%kernel.secret%'
423419
# ...
424420
token_provider:
425421
doctrine: true
@@ -442,7 +438,7 @@ You can enable the doctrine token provider using the ``doctrine`` setting:
442438
<firewall name="main">
443439
<!-- ... -->
444440
445-
<remember-me secret="%kernel.secret%">
441+
<remember-me>
446442
<token-provider doctrine="true"/>
447443
</remember-me>
448444
</firewall>
@@ -459,7 +455,6 @@ You can enable the doctrine token provider using the ``doctrine`` setting:
459455
$security->firewall('main')
460456
// ...
461457
->rememberMe()
462-
->secret('%kernel.secret%')
463458
// ...
464459
->tokenProvider([
465460
'doctrine' => true,

0 commit comments

Comments
 (0)