"Remember Me" is convenient. It's also the reason many websites ask you to re-enter your password before changing your email address, password, or other sensitive settings. There's a good security reason for that 🔐 youtu.be/j2s_xZgYNss
youtu.beWhy "Remember Me" Isn't Fully AuthenticatedChecking "Remember Me" keeps users logged in, but that doesn't mean they're fully authenticated.
A remembered user is less trustworthy than someone who just entered their password. That's why sensitive actions - like changing an email address or password - often require you to authenticate again.
It's a small distinction that makes a big difference for your application's security.
Watch the full SymfonyCasts lesson 👉 https://symfonycasts.com/screencast/symfony8-security/authentication-attributes
1 repost1 like