“And all I need to do is sniff your cookie and you secure access is all mine”

Using any of these methods would allow a captured “Remember Me” cookie to be used to access the supposed secure system.

And I am fairly sure a cookie is easy to capture (sniff), and it wont matter that its encrypted because I dont need to decrypt it, just present it.

If I am wrong, please feel free to set me right, seriously, please do.

“This login() function is run every time a user accesses a page that needs authentication (I think)”.

This is not true.

You can use the User::login method to just add the user cookie in case authentication succeeds and the user asks to be remembered.

Then use AppController::beforeFilter to try to authenticate the user based on the user cookie information in case Auth->user() is null.

myltik’s last blog post..??????????? ?? ????????????? – ?????????? ?? MIKArom

One observation though, it seems that $this->redirect($this->Auth->logout()); doesnt log the user out of all open windows.

Say a user has an authentic site open in more than one window, if you log out from one, the others remain logged in!

Is there a work around this?
Or am I doing something wrong?

And if you’re using the code above right, Auth shouldn’t be running this function on it’s own.

If statement needs to be modified: if (!empty($this->data) && $this->data['User']['remember_me']) {

ThanX!

Often you want to display user information (welcome back, username) on a page that doesn’t need authentication, like your home page, but that won’t work anymore because the cookie isn’t checked right..

Of course there’s a solution, this is what works for me at least, some code in app_controller.php’s beforeFilter function:
$cookie = $this->Cookie->read(‘Auth.User’);
if (!is_null($cookie))
{
if ($this->Auth->login($cookie))
{
$this->Session->del(‘Message.auth’);
}
}