"Remember Me" functionality

Question

I'm sure that this question/issue has been resolved some way because I've seen it working on sites like devot-ee, but how can I get the 'Remember Me' functionality working for when user login to the front-end of a site?

Thanks in advance.

~ Lucas

Answer 1

If you already have the auto_login field in your login form and it's just not working, you are probably running into a long standing bug where Remember Me just doesn't work consistently or correctly. Here are two possibly related bug reports:

http://expressionengine.com/bug_tracker/bug/16355

http://expressionengine.com/bug_tracker/bug/17423

Answer 2

Add a checkbox with the name auto_login to your login form

<input class="checkbox" type="checkbox" name="auto_login" value="1" /> Auto-login on future visits

Answer 3

So this may or may not solve your issue but we were having problems getting this to work for quite awhile and I decided to make my own patch to the EE core files. It only works for my instance but if you can get the general idea if should help you.

The remember me functionality is broken for multi site logins (so this patch will only work for that).

There are two parts that are important for the remember_me to work.

1. The user needs to have the remember me cookie in their browser with the associated hashed key

2. The user needs to have the remember_me entry in the exp_members table filled with the same hash value

The issue with multi site login is that it gives the cookie in the first login and fills the members table with the hash value. It then redirects to do the second (or more) site logins but without the remember_me input being checked in the form (that is the bug) which causes the remember_me field in the members table to be wiped out.

Though I believe there is a more elegant solution involving passing the hashkey generated o the first login along with the checked remember me input through to the next logins, I haven't gone that far yet. My solution will solve remember_me issues for the first site (which is all we really required).

WARNING: It involves modifying core files which I have a lot of experience with. This is sort of an advanced user patch.

Solution:

Add a field to the members table, remember_me_timestamp INT(10).

Modify the function start_session in the core Auth.php file to do a timecheck on when the remember me was filled:

        $SITE_MEMBER_ID = $this->member('member_id');

    if(empty($remember))
    {
        $this->EE->db->query("UPDATE exp_members SET remember_me_timestamp = UNIX_TIMESTAMP() WHERE member_id = '$SITE_MEMBER_ID' LIMIT 1");
        // update the remember me column
        $this->EE->db->where('member_id', $this->member('member_id'));
        $this->EE->db->update('members', array(
                'remember_me' => $remember
        ));
    }
    else
    {
        //check previous remember me time

        $SITE_remember_time_query = $this->EE->db->query("SELECT remember_me_timestamp as lastRemember, UNIX_TIMESTAMP() as currentTime 
        FROM exp_members WHERE member_id = '$SITE_MEMBER_ID' LIMIT 1");

        $SITE_remember_time = $SITE_remember_time_query->row('lastRemember');
        $SITE_current_time = $SITE_remember_time_query->row('lastRemember');

        $SITE_more_than_one_hour = ($SITE_current_time - 60*60) > $SITE_remember_time ? TRUE : FALSE; 

        //if no last remember time then just let clear the remember me field, else don't touch it
        if(empty($SITE_remember_time) || $SITE_more_than_one_hour )
        {
                // update the remember me column
            $this->EE->db->where('member_id', $this->member('member_id'));
            $this->EE->db->update('members', array(
                    'remember_me' => $remember
            ));     

        }           

    }

That was the code I added to the start_session function. Replacing:

            $this->EE->db->where('member_id', $this->member('member_id'));
        $this->EE->db->update('members', array(
                'remember_me' => $remember
        ));

The idea is that when it does the first login, it has the remember me post data filled so it inserts the key, sets the cookie and also inserts the timestamp. On subsequent site logins (which happen consecutively in a small span of time) if the remember me post data is empty (which it will be because of the bug) then it checks the timestamp to see if an hour has past since the last remember me (really it could be like 10 seconds). If the time limit hasn't been passed then it won't blank out the remember_me field in the members table.

Hopefully this helps some people but considering the skill level usually required to edit core files, I would prefer to see ellislabs make an actual patch (they could have by now I suppose, I just don't updated because of all my custom edits).