From f003fe600b564e754ff4c4080a7a9f895743aa03 Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sun, 16 Aug 2026 09:19:04 +0300 Subject: [PATCH 1/3] Add note about cookie protection --- README.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/README.md b/README.md index 4ec205f..880ac0b 100644 --- a/README.md +++ b/README.md @@ -308,6 +308,12 @@ final class CookieLoginIdentityRepository implements IdentityRepositoryInterface The `CookieLoginMiddleware` will check for the existence of a cookie in the request, validate it and login the user automatically. +> [!note] +> The auto-login cookie value isn't protected against tampering by this package. This isn't only about +> the end user editing their own cookie, anyone who steals the cookie value can modify it too, e.g. to +> remove its expiration. Use `CookieMiddleware` from [`yiisoft/cookies`](https://github.com/yiisoft/cookies) +> to sign or encrypt it if you want to prevent that. + #### Creating a cookie By default, you should set cookie for auto login manually in your application after logging user in: From a932011d69d959878d2291d88236afaf69421b27 Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sun, 16 Aug 2026 09:21:04 +0300 Subject: [PATCH 2/3] improve --- README.md | 2 +- src/Login/Cookie/CookieLoginMiddleware.php | 5 +++++ 2 files changed, 6 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index 880ac0b..7dd138b 100644 --- a/README.md +++ b/README.md @@ -310,7 +310,7 @@ validate it and login the user automatically. > [!note] > The auto-login cookie value isn't protected against tampering by this package. This isn't only about -> the end user editing their own cookie, anyone who steals the cookie value can modify it too, e.g. to +> the end user editing their own cookie — anyone who steals the cookie value can modify it too, e.g. to > remove its expiration. Use `CookieMiddleware` from [`yiisoft/cookies`](https://github.com/yiisoft/cookies) > to sign or encrypt it if you want to prevent that. diff --git a/src/Login/Cookie/CookieLoginMiddleware.php b/src/Login/Cookie/CookieLoginMiddleware.php index c3b45c9..1d617aa 100644 --- a/src/Login/Cookie/CookieLoginMiddleware.php +++ b/src/Login/Cookie/CookieLoginMiddleware.php @@ -26,6 +26,11 @@ /** * `CookieLoginMiddleware` automatically logs user in based on cookie. + * + * The auto-login cookie value isn't protected against tampering by this package. This isn't only about + * the end user editing their own cookie — anyone who steals the cookie value can modify it too, e.g. to + * remove its expiration. Use `CookieMiddleware` from {@link https://github.com/yiisoft/cookies} to sign + * or encrypt it if you want to prevent that. */ final class CookieLoginMiddleware implements MiddlewareInterface { From 299c250f7c55627127355fec5b4aa057fc9e379f Mon Sep 17 00:00:00 2001 From: Sergei Predvoditelev Date: Sun, 16 Aug 2026 09:22:27 +0300 Subject: [PATCH 3/3] improve --- src/Login/Cookie/CookieLoginMiddleware.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/Login/Cookie/CookieLoginMiddleware.php b/src/Login/Cookie/CookieLoginMiddleware.php index 1d617aa..90f1902 100644 --- a/src/Login/Cookie/CookieLoginMiddleware.php +++ b/src/Login/Cookie/CookieLoginMiddleware.php @@ -13,6 +13,7 @@ use RuntimeException; use Throwable; use Yiisoft\Auth\IdentityRepositoryInterface; +use Yiisoft\Cookies\CookieMiddleware; use Yiisoft\User\CurrentUser; use function array_key_exists; @@ -29,8 +30,7 @@ * * The auto-login cookie value isn't protected against tampering by this package. This isn't only about * the end user editing their own cookie — anyone who steals the cookie value can modify it too, e.g. to - * remove its expiration. Use `CookieMiddleware` from {@link https://github.com/yiisoft/cookies} to sign - * or encrypt it if you want to prevent that. + * remove its expiration. Use {@see CookieMiddleware} to sign or encrypt it if you want to prevent that. */ final class CookieLoginMiddleware implements MiddlewareInterface {