'How do I delete the remember_me cookie when I log out?
I am currently using symfony 5.4 and i wanted to understand how to remove the REMEMBERME server side
I am trying to set the delete_cookies parameter in the security.yaml under the logout:
main:
lazy: true
provider: app_user_provider
switch_user: true
form_login:
login_path: app_login
check_path: app_login
remember_me:
secret: '%kernel.secret%'
lifetime: 604800 # 1 week in seconds
secure: true
logout:
path: app_logout
delete_cookies:
REMEMBERME: { path: null, domain: null}
but in the same way if with postman I redo a call in a protected route by putting only the REMEMBERME cookie, even without being logged in, it shows me the protected route ... in this way if someone manages to intercept a REMEMBERME of any connected user they can access the system ...
Sources
This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.
Source: Stack Overflow
| Solution | Source |
|---|
