RememberMeStore
final class RememberMeStore
Owns remember-me persistence: minting the cookie token and its hashed user_sessions row, and tearing both down on logout.
Security invariant: the raw token is placed only in the user's cookie; the user_sessions row stores only its hash (see RememberToken). The two are reconciled at auto-login time by hashing the incoming cookie value and matching it against the stored hash, so a leaked user_sessions table never exposes usable tokens. Any change here must preserve that split — never store the raw token, and never put the hash in the cookie.
The store is keyed by user id plus user agent, so each device holds an independent token; persisting for a device first clears that device's prior row.
Methods
Removes the persisted token row and cookie for the current request.
Details
at line 34
void
forget()
Removes the persisted token row and cookie for the current request.
Mirrors the remember-me half of the prior logoutUser(). Safe to call when no remember-me cookie or row exists — both are checked first.
at line 53
void
persist(Principal $user)
Persists a remember-me token for the user: the raw token is written to the cookie, and only its hash is stored in user_sessions. Any existing row for this user and user agent is removed first, so a device holds a single current token. Mirrors the prior loginUser() block.