How to change the "remember-me" Laravel cookie lifetime? - laravel

Question

I use the built-in "Remember me" functionnality of Laravel 5.8. I checked the cookies and saw the remember-me cookie expires in about 5 years. That is way to long and I would like to shorten it. As Laravel automaticly creates the cookie, I don't have the hand on it. How can I do this ?

Answer 1

The remember me duration can be overridden by overriding the AuthenticatesUsers trait. You could add the following code to LoginController that overrides the trait in the following controller:
protected function sendLoginResponse(Request $request)
{
$customRememberMeTimeInMinutes = 10;
$rememberTokenCookieKey = Auth::getRecallerName();
Cookie::queue($rememberTokenCookieKey, Cookie::get($rememberTokenCookieKey), $customRememberMeTimeInMinutes);
$request->session()->regenerate();
$this->clearLoginAttempts($request);
return $this->authenticated($request, $this->guard()->user())
?: redirect()->intended($this->redirectPath());
}
An alternative is to invalidate the remember me session by setting the remember_token in the users table to an empty value.
Example:
$user = Auth::user();
$user->remember_token = null;
$user->save();

Answer 2

This is (at time of writing) so much easier with Laravel 8 (and likely earlier).
Just add the key remember to the appropiate guard in your config/auth.php file. In this example I have a custom guard called customGuard
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
'customGuard' => [
'driver' => 'session',
'provider' => 'users',
'remember' => "10080" //Number of minutes the "remember me" option works for.
],
'api' => [
'driver' => 'token',
'provider' => 'users',
'hash' => false,
],
],

Answer 3

You can set the remember me cookie duration by adding 'remember' => 43800 in the config in config/auth.php
Just change:
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
],
],
to:
'guards' => [
'web' => [
'driver' => 'session',
'provider' => 'users',
'remember' => 43800 // Set remember me duration here (minutes)
],
],
Note: The 'remember' key is a mandatory keyword, because it will be read by laravel in Illuminate\Auth\AuthManager namespace