Add note about cookie protection

README.md

@@ -308,6 +308,12 @@ final class CookieLoginIdentityRepository implements IdentityRepositoryInterface
 The `CookieLoginMiddleware` will check for the existence of a cookie in the request,
 validate it and login the user automatically.
 
+> [!note]
+> The auto-login cookie value isn't protected against tampering by this package. This isn't only about
+> the end user editing their own cookie — anyone who steals the cookie value can modify it too, e.g. to
+> remove its expiration. Use `CookieMiddleware` from [`yiisoft/cookies`](https://github.com/yiisoft/cookies)
+> to sign or encrypt it if you want to prevent that.
+
 #### Creating a cookie
 
 By default, you should set cookie for auto login manually in your application after logging user in:

src/Login/Cookie/CookieLoginMiddleware.php

@@ -13,6 +13,7 @@
 use RuntimeException;
 use Throwable;
 use Yiisoft\Auth\IdentityRepositoryInterface;
+use Yiisoft\Cookies\CookieMiddleware;
 use Yiisoft\User\CurrentUser;
 
 use function array_key_exists;
@@ -26,6 +27,10 @@
 
 /**
  * `CookieLoginMiddleware` automatically logs user in based on cookie.
+ *
+ * The auto-login cookie value isn't protected against tampering by this package. This isn't only about
+ * the end user editing their own cookie — anyone who steals the cookie value can modify it too, e.g. to
+ * remove its expiration. Use {@see CookieMiddleware} to sign or encrypt it if you want to prevent that.
  */
 final class CookieLoginMiddleware implements MiddlewareInterface
 {
@@ -41,7 +46,7 @@
         private IdentityRepositoryInterface $identityRepository,
         private LoggerInterface $logger,
         private CookieLogin $cookieLogin,
         private bool $forceAddCookie = false,
     ) {}
 
     /**
@@ -94,7 +99,7 @@
         }
 
         try {
             $data = json_decode((string) $cookies[$cookieName], true, 512, JSON_THROW_ON_ERROR);
         } catch (Throwable) {
             $this->logger->warning('Unable to authenticate user by cookie. Invalid cookie.');
             return;
@@ -129,12 +134,12 @@
 
         if (!$identity->validateCookieLoginKey($key)) {
             $this->logger->warning('Unable to authenticate user by cookie. Invalid key.');
             return;
         }
 
         if ($expires !== 0 && $expires < time()) {
             $this->logger->warning('Unable to authenticate user by cookie. Lifetime has expired.');
             return;
         }
 
         $this->currentUser->login($identity);