Where is remember_me cookie checked in Laravel? - laravel

Question

When I login using the remember_me feature in Laravel 5.8, a remember_me token is stored in the users table and in the cookie. When a user opens the page with expired session, then at some place in Laravel the cookie value must be compared to the remember_token and re-login the user. But where exactly does this take place?
I checked Illuminate\Auth\SessionGuard but could not find that anywhere. I need to catch this event, because I need to update the session on my Login-server using the refresh token.

Answer 1

Its in Illuminate\Auth\SessionGuard in the user() method.
There is this code section:
// If the user is null, but we decrypt a "recaller" cookie we can attempt to
// pull the user data on that cookie which serves as a remember cookie on
// the application. Once we have a user we can return it to the caller.
$recaller = $this->recaller();
if (is_null($this->user) && ! is_null($recaller)) {
$this->user = $this->userFromRecaller($recaller);
if ($this->user) {
$this->updateSession($this->user->getAuthIdentifier());
$this->fireLoginEvent($this->user, true);
}
}
The variable $recaller holds the cookie value.
The method userFromRecaller will try to retrieve user by Token:
protected function userFromRecaller($recaller)
{
if (! $recaller->valid() || $this->recallAttempted) {
return;
}
// If the user is null, but we decrypt a "recaller" cookie we can attempt to
// pull the user data on that cookie which serves as a remember cookie on
// the application. Once we have a user we can return it to the caller.
$this->recallAttempted = true;
$this->viaRemember = ! is_null($user = $this->provider->retrieveByToken(
$recaller->id(), $recaller->token()
));
return $user;
}
From here you have to check which provider driver you have specifified in config/auth.php (eloquent or database), depending on that you can continue the path on the method retrieveByToken on EloquentUserProvider or DatabaseUserProvider.
For example, the EloquentUserProvider will compare the token value with the remembertoken of the model like this:
public function retrieveByToken($identifier, $token)
{
$model = $this->createModel();
$model = $model->where($model->getAuthIdentifierName(), $identifier)->first();
if (! $model) {
return null;
}
$rememberToken = $model->getRememberToken();
return $rememberToken && hash_equals($rememberToken, $token) ? $model : null;
}
The method getRememberToken() is definied on the Users model via the Authenticatable trait.