Who this is for. Whoever is asked to "keep members logged in". Afterwards you know what remember-me does on this platform, which members it helps, and what to tell members on shared computers.
The settings
In the OAuth module's settings, under Remember Me:
| Setting | Default | Effect |
|---|---|---|
| Enable | Off | On, members are asked after each sign-in on the website whether to be remembered |
| Days | 30 | How long a browser is remembered |
The prompt
With remember-me on, every sign-in on the website stops at /oauth/remember-me before the member reaches their destination: a page asking whether the site should remember them, with No and Yes buttons that post response=no or response=yes back to the same address. Sign-ins to the admin are never asked. The framework ships the page for both engines. To restyle it, a Smarty site overrides o-auth/frontend/remember-me.html and a Twig site o-auth/frontend/remember-me-twig.html; keep the two buttons and their values, and keep the advice to answer No on a shared or public computer.
What is stored
Answering Yes stores a renewal token for the member and sets a cookie, remember_me, in that browser for the number of days set. Like the sign-in cookie it is Secure, HttpOnly and SameSite=Lax, and it belongs to the exact hostname.
When the member comes back after their twelve-hour sign-in has expired, the platform uses the cookie to try to start a new session without asking them to sign in. It does so by refreshing one of the member's provider links: Google and Microsoft sign-ins keep a refresh token the platform can use. If none of the member's links can be refreshed, the member signs in as usual, with no interruption.
So remember-me helps only members who sign in through a provider: a password sign-in or a passkey has no refresh token to use, so answering Yes has no effect for that member. On a site where members sign in only with passwords, leave remember-me off, since it would have nothing to offer them.
How it is revoked
- Signing out removes the renewal token and the cookie in that browser. A member on a shared computer who signs out is not remembered there.
- Expiry. The cookie and its token stop working after the number of days set.
- Deactivating the account, by setting the user Inactive or Disabled, revokes every renewal token the member holds.
A member who answered Yes on a shared computer and left without signing out leaves a browser that can sign back in as them while the provider link refreshes. That is why the prompt's advice matters, and why a site used mainly on shared machines, such as a library's or a school's, should leave remember-me off.