Persistent Login / Remember user

[Can]

Hey guys,

I'm building a module to keep a user logged in until manual logout. I know about Login Persist, but this one stopped working for me a while ago and it might not even be compatible with pw3 (haven't tested this) as it's not being updated for 3 years

Anyways, the module works, and now I want to secure user edit screens namely ProcessPageEdit (any user template, as there might be multiple) and ProcessProfile
by requiring the current password..  I know how to add the additional input (added by hooking into ProcessProfile::execute and ProcessPageEdit::buildForm or Page::render) but I don't know how to intercept the saving and canceling the save if password doesn't match

I thought about emptying $input->post (don't even know if this works?) if not valid but would be nice not to loose the changed data but instead just notify user about a wrong password..

would love to get some thoughts and input on this

[kixe]

First of all, a persistent login is always a balance between user-friendliness and security aspects. There are two related $config settings.

/**
 * Use session fingerprint?
 *
 * Should login sessions be tied to IP and user agent?
 * IP fingerprinting may be problematic on dynamic IPs.
 * Below are the possible values:
 *
 *     0 or false: Fingerprint off
 *     1 or true: Fingerprint on with default/recommended setting (currently 10).
 *     2: Fingerprint only the remote IP
 *     4: Fingerprint only the forwarded/client IP (can be spoofed)
 *     8: Fingerprint only the useragent
 *     10: Fingerprint the remote IP and useragent (default)
 *     12: Fingerprint the forwarded/client IP and useragent
 *     14: Fingerprint the remote IP, forwarded/client IP and useragent (all).
 *
 * @var int
 *
 */
$config->sessionFingerprint = 1;

/**
 * Session expiration seconds
 *
 * How many seconds of inactivity before session expires
 *
 * @var int
 *
 */
$config->sessionExpireSeconds = 86400;

The easiest way would be to force a log out, if ProcessProfile or ProcessPageEdit is requested and show the default login screen. You could compare the current user-agent, IP or duration of the session with current session data. This can be different from default (more lazy) $config settings.

[Robin S]

9 hours ago, Can said:

I know about Login Persist, but this one stopped working for me a while ago and it might not even be compatible with pw3 (haven't tested this) as it's not being updated for 3 years

FYI: I just checked the LoginPersist module and it's working for me in PW3.

[Can]

great info thanks @kixe and @Robin S

logging out could be an option..could be a little confusing though..maybe combined with some notification..thought an extra input would be more understandable