Cookie Expiration Not Honored

[cobhimself]

Thanks for the great extension!

I'm having an issue with the cookies expiring before they should. I've verified that the 'frontend' cookie has an expiration date 1 year in the future but, regardless, the cookies are still expiring. This happens on a myriad of different devices/browsers so I don't think it's an issue with browser settings. I'm using Magento EE 1.9.1.1.

Steps I've Taken

• I installed the extension and verified the extension is recognized and is run.
• I placed php_value session.gc_maxlifetime 2592000 in the site's .htaccess file.
• Viewed cookie expiration value within the browser to verify the expiration is set to 1 year from the time the cookie was created.

After doing the above, I modified the Cookie.php file provided in the extension to include some logging functionality so we can see what is going on.

Cookie.php

<?php
/**
 * NOTICE OF LICENSE
 *
 * This source file is subject to the Open Software License (OSL 3.0)
 * that is bundled with this package in the file LICENSE.txt.
 * It is also available through the world-wide-web at this URL:
 * http://opensource.org/licenses/osl-3.0.php
 *
 *
 * @category   Customer
 * @package    Clockworkgeek_Rememberme
 * @author     Daniel Deady <daniel@clockworkgeek.com>
 * @copyright  Copyright (c) 2010, Daniel Deady
 * @license    http://opensource.org/licenses/osl-3.0.php  Open Software License (OSL 3.0)
 */

class Clockworkgeek_Rememberme_Model_Cookie extends Mage_Core_Model_Cookie
{

    /**
     * Set cookie
     * Override period if asked to
     *
     * @param string $name The cookie name
     * @param string $value The cookie value
     * @param int $period Lifetime period
     * @param string $path
     * @param string $domain
     * @param int|bool $secure
     * @return Mage_Core_Model_Cookie
     */
    public function set($name, $value, $period = null, $path = null, $domain = null, $secure = null, $httponly = null)
    {
        if (is_null($period)) {
            Mage::log('Setting cookie ' . $name . ':');
            Mage::log("set($name, $value, $period, $path, $domain, $secure, $httponly)");
            // use $_SESSION directly as session classes may not be initialised yet
            $session = ( isset($_SESSION['rememberme']) ? (bool)$_SESSION['rememberme'] : false );
            $login = Mage::app()->getRequest()->getPost('login');
            $rememberme = ( isset($login['rememberme']) ? (bool)$login['rememberme'] : false );
            $period = $session || $rememberme; // true = one year
        }

        Mage::log("parent::set($name, $value, $period, $path, $domain, $secure, $httponly)");
        return parent::set($name, $value, $period, $path, $domain, $secure, $httponly);
    }

    /**
     * Add our flag on login
     */
    public function setSessionRemembrance()
    {
        if (isset($_SESSION) && !isset($_SESSION['rememberme'])) {
            $login = Mage::app()->getRequest()->getPost('login');
            $_SESSION['rememberme'] = isset($login['rememberme']) && $login['rememberme'];
            Mage::log('setSessionRemembrance() --> $_SESSION[rememberme] = ' . $_SESSION['rememberme']);
        }
    }

    /**
     * Remove our flag on logout
     */
    public function unsetSessionRemembrance()
    {
        Mage::log('unsetSessionRemembrance()');
        if (isset($_SESSION['rememberme'])) unset($_SESSION['rememberme']);
    }

}

Log Output

I then ran a couple of different scenarios. The log output is below:

No 'Remember Me' Login

Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
setSessionRemembrance() --> $_SESSION[rememberme] =
Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )

No 'Remember Me' Logout

Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
unsetSessionRemembrance()
Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )

With 'Remember Me' Login

Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, 1, , , , )
setSessionRemembrance() --> $_SESSION[rememberme] = 1
Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, 1, , , , )
Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, 1, , , , )

With 'Remember Me' Logout

Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, 1, , , , )
unsetSessionRemembrance()
Setting cookie frontend:
set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )
parent::set(frontend, 0r3kd363akl2b49smcja14peh2, , , , , )

It appears the set() function is being called multiple times when logging in and logging out. Is this normal? After looking at the logs above, do you see any issue with the way the extension is behaving?

Session Cookie Management

Do I need to modify any of the settings for session cookie management within the admin panel at System -> Configuration -> Web -> Session Cookie Management?

Thanks again for the extension!

[clockworkgeek]

Thank you for the very professional and detailed bug report.

You don't say when cookies are expiring. What are you expecting to happen? Here are the scenarios I expected.

No 'Remember Me' login

• User does not check the checkbox when logging in.
• User closes browser window. (Cookie is lost here)
• User reopens browser window and find themselves logged out. (Same as default Magento behaviour)

With 'Remember Me' login

• User checks the checkbox when logging in.
• User closes browser window.
• User reopens browser window and is still logged in.

With and without 'Remember Me' logout

• User clicks "logout" link to log out manually.
• Cookie is unset.

[cobhimself]

Thanks for the quick response.

All of your expectations outlined above match my own. Regarding the "With 'Remember Me' login" scenario though, while the user does remain logged in when the browser window is closed and re-opened, this behavior doesn't seem to persist past 60 minutes; users still have to log back in after they have been inactive for that amount of time.

I was able to confirm that the 'frontend' cookie that stores the session key value does have its expiration set to the current time plus 1 year. Knowing this, it would seem the session would persist for that long, correct?

[clockworkgeek]

I have a suspicion that session.gc_maxlifetime isn't sticking. Sometimes values set in .htaccess files are ignored, in which case you need to make the change in the server's httpd.conf file or set Options All for your site.

You can test more thoroughly by setting up a phpinfo() script and reading what value is actually being used. This will let you know if any change you make is successful.

Perhaps you have highlighted a need to check the maxlifetime setting automatically..