gbirke / rememberme

A PHP library that implements secure "Remember me" cookies
MIT License
125 stars 30 forks source link

Fix cleaning of expired tokens #59

Open m-ober opened 2 years ago

m-ober commented 2 years ago

The column $expiresColumn stores the expiry timestamp, which is calculated like: $expire = time() + $this->expireTime.

OTOH, the code to clean the expired tokens looks like this:

if ($this->cleanExpiredTokensOnLogin) {
    $this->storage->cleanExpiredTokens(time() - $this->expireTime);
}

This leads to the tokens being valid for twice the expireTime.