Would you like to work on a PR that would follow #27427 (comment)?

I would, is preferred solution to skip authentication of already authenticated user?

Any hint @weaverryan or @chalasr, etc.?

Do I understand this correctly that with “Remember Me” enabled, the session ID changes for every request?

Asking because I am chasing spurious failures on a CI where concurrent requests (headless browser/AJAX) lead to lost sessions.

@mpdude yeah that seems to be the case.
EDIT: The session ID stays the same. It's the remember me cookie value that changes.

I'm running into the problem that I have an ajax request that runs every 5 seconds in the back-ground and if the user changed pages before that request finishes it will never get the new value for the remember me cookie so therefor it sends the old value which then Symfony sends a new set-cookie header with the value "deleted".

It really sucks that this functionality cannot be disabled and is on by default. I could make the ajax request blocking but that isn't really a solution and is just a gross work-around. Would be nice if ajax requests were ignored for updating the remember me cookie.

If you duplicate the service and remove the logic that generates a new token on every request it fixes it. I just posted a blog entry on my website with how to do just this: https://skylar.tech/fix-for-concurrent-requests-breaking-symfonys-rememberme/

I still don't understand why the PersistentTokenBasedRememberMeServices resets the token on every request but the default TokenBasedRememberMeServices does not. It also sucks that this "feature" isn't documented anywhere and PersistentTokenBasedRememberMeServices is only mentioned to be used for storing the remember me tokens in the database (which obviously makes sense from the name).

I think the documentation should be updated and this "feature" should be able to be disabled/enabled without overwriting the service.

EDIT:
I also like the idea of making tokens work for 1-2 minutes after they "expire" as that would prevent concurrent requests breaking things but would also give you the benefit of tokens auto-rotating.

I opened #41175 which aims to fix this issue, if anyone wants to help out or take a look at least.

@skylord123 one part I don't understand about your feedback though, is that in my experience the session id and token only change when remember-me is being used to authenticate. Do you not store sessions at all in your code, and rely purely on persistent tokens for authentication on every request? If so that should be improved already in 5.3.0 by #40972 which will only refresh the token once a minute.

@Seldaek PersistentTokenBasedRememberMeServices always refreshes the token on every request whereas the default TokenBasedRememberMeServices does not.

Check the processAutoLoginCookie function in both of those classes. You will see for the PersistentTokenBasedRememberMeServices it has these lines:

        $tokenValue = base64_encode(random_bytes(64));
        $this->tokenProvider->updateToken($series, $this->generateHash($tokenValue), new \DateTime());
        $request->attributes->set(self::COOKIE_ATTR_NAME,
            new Cookie(
                $this->options['name'],
                $this->encodeCookie([$series, $tokenValue]),
                time() + $this->options['lifetime'],
                $this->options['path'],
                $this->options['domain'],
                $this->options['secure'] ?? $request->isSecure(),
                $this->options['httponly'],
                false,
                $this->options['samesite']
            )
        );

Whereas if you look at the exact same function inside of TokenBasedRememberMeServices and it does not set this cookie on every request.

I store sessions in my code. I am using the default authentication system. I just moved to use PersistentTokenBasedRememberMeServices so my sessions would store in the DB and the documentation for this feature doesn't specify at all that the token will be refreshes every request. This makes me to believe this was unintentionally done.

If you check out my blog link I posted you will see that all I do to fix this is copy the class and comment out the part of the PersistentTokenBasedRememberMeServices that sets the cookie on every request. I only care about the cookie being set in onLoginSuccess.

EDIT: As far as I know the processAutoLoginCookie gets ran on every request. Not just when the token is being used.

EDIT 2: Shouldn't these two classes function identically except one stores in the DB? If we are going to auto-rotate the remember me token on every request it should be done for both classes not just for persistent storage.

@skylord123 I can not reproduce this, for me PersistentTokenBasedRememberMeServices::processAutoLoginCookie only gets called if I delete my session cookie, it gets called once while the reauthentication happens and then not anymore on subsequent requests. I'm using Symfony 5.2 and the new Authenticator stuff, not sure if that makes a difference, but IMO the PersistentTokenBasedRememberMeServices should not be called if an active session is present due to https://github.com/symfony/symfony/blob/5.2/src/Symfony/Component/Security/Http/Authenticator/RememberMeAuthenticator.php#L55-L58

@Seldaek That is strange. I am running 5.2 using the latest security setup as well. I am for sure logged into my app (deleting the remember me token and I stay logged in). I put a dump on $this->tokenStorage->getToken() and it returns null for some reason (despite when I comment that out I am for sure logged in).

@Seldaek So I noticed my firewall had the lazy option set to true. When I set this to false the token stops updating on every request and $this->tokenStorage->getToken() returns my token.

So maybe this is just broken for lazy sessions?

@skylord123 ok that is interesting, indeed I have lazy:false. I'm not familiar enough with lazy mode to know if or how this could be fixable sorry. This does sound to me like a bug though, as recreating the remember me token (or even the cookie if using remember me without token_provider) seems pretty broken.