gbirke / rememberme

A PHP library that implements secure "Remember me" cookies
MIT License
125 stars 30 forks source link

expireTime of Authenticator not forwarded to PHPCookie class #25

Open ffh-webadmin opened 6 years ago

ffh-webadmin commented 6 years ago

If you set

$rememberMe = new Birke\Rememberme\Authenticator(); $rememberMe->setExpireTime(7776000);

this value will not be transferred to the instance of PHPCookie class, as there is only a

if (is_null($cookie)) { $cookie = new PHPCookie(); }

I could solve this by creating the Cookie object by my own.

cookie = new Birke\Rememberme\Cookie\PHPCookie( null, 7776000 ); $rememberMe = new Birke\Rememberme\Authenticator($storage, null, $cookie); $rememberMe->setExpireTime(7776000);

But I think it would be much easier if the library will handle it correctly by its own.

gbirke commented 4 years ago

Thanks for pointing this out!

The solution will be a bit more complex, since there are 3 places where the expiry date needs to be kept in sync: in the constructor, in setExpireTime and in setCookie (where the authenticator might or might not override the cookie settings). Also the PHPCookie class then needs to support setting the expire time outside of the constructor and call setValue internally when the expiry value changes.

Feel free to provide a patch, I'll leave this open as a feature request for now.