Repository: glpi-project/glpi (PHP)

Issue:
API HL documentation authentication depends on the `remember_me` feature activation
The authentication using the `authorizationCode` flow requires the `remember_me` feature to be enabled and the `Remember me` checkbox to be checked during the authentication.
See https://github.com/glpi-project/glpi/blob/5067f3b55193d7b944404ca43cc1e64b61c089d8/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php#L45

If the feature is disabled or if the checkbox is not checked, it leads to an infinite redirection loop.

The feature can be disabled from the `Setup > General setup > Auto login` form.
![Image](https://github.com/user-attachments/assets/06779811-9cd0-4aa0-a48b-3bdf52a67889)

Connexion on the API not working
### Code of Conduct

- [x] I agree to follow this project's Code of Conduct

### Is there an existing issue for this?

- [x] I have searched the existing issues

### Version

11.0.0

### Bug description

The REST API connection is not working on the beta version.

When I use the **Authorize** button on api.php/v2/doc, I get stuck in a redirection loop (multiple HTTP 302 responses) between:

- /authorize?...
-/?redirect=... 

Example URLs involved:

`/api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect`

`/?redirect=http://glpi11-wsl.lan/api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=%2Fapi.php%2Fswagger-oauth-redirect`

It works fine on the alpha version. I correctly get the authorization page, with the following URL:

![Image](https://github.com/user-attachments/assets/51381738-14c2-4d1f-ba11-1272cfb56ffb)

`api.php/authorize?response_type=code&client_id=a2f84744644315907c6ef2dff4e921c9c34c046bacdec69122b5390ebad2134c&redirect_uri=/api.php/swagger-oauth-redirect&scope=inventory api user email status&state=RnJpIEFwciAxOCAyMDI1IDE1OjA3OjE5IEdNVCswMjAwIChoZXVyZSBk4oCZw6l0w6kgZOKAmUV1cm9wZSBjZW50cmFsZSk=`

I tested with empty IP restrictions and with '127.0.0.1,192.168.1.41' set on the OAuth client (See the PHP log below).





### Relevant log output

```shell
[2025-04-18 14:22:27] glpi.WARNING:   *** Warning: Trying to access array offset on null at IPRestrictionRequestMiddleware.php line 62
  Backtrace :
  ...iddleware/IPRestrictionRequestMiddleware.php:62
  ...lpi/Api/HL/Middleware/AbstractMiddleware.php:52 Glpi\Api\HL\Middleware\IPRestrictionRequestMiddleware->process()
  ./src/Glpi/Api/HL/Router.php:557                   Glpi\Api\HL\Middleware\AbstractMiddleware->__invoke()
  ...Api/HL/Middleware/OAuthRequestMiddleware.php:55 Glpi\Api\HL\Router::Glpi\Api\HL\{closure}()
  ...lpi/Api/HL/Middleware/AbstractMiddleware.php:52 Glpi\Api\HL\Middleware\OAuthRequestMiddleware->process()
  ./src/Glpi/Api/HL/Router.php:557                   Glpi\Api\HL\Middleware\AbstractMiddleware->__invoke()
  ...Api/HL/Middleware/DebugRequestMiddleware.php:49 Glpi\Api\HL\Router::Glpi\Api\HL\{closure}()
  ...lpi/Api/HL/Middleware/AbstractMiddleware.php:52 Glpi\Api\HL\Middleware\DebugRequestMiddleware->process()
  ./src/Glpi/Api/HL/Router.php:557                   Glpi\Api\HL\Middleware\AbstractMiddleware->__invoke()
  .../Api/HL/Middleware/RSQLRequestMiddleware.php:49 Glpi\Api\HL\Router::Glpi\Api\HL\{closure}()
  ...lpi/Api/HL/Middleware/AbstractMiddleware.php:52 Glpi\Api\HL\Middleware\RSQLRequestMiddleware->process()
  ./src/Glpi/Api/HL/Router.php:557                   Glpi\Api\HL\Middleware\AbstractMiddleware->__invoke()
  ./src/Glpi/Api/HL/Router.php:559                   Glpi\Api\HL\Router::Glpi\Api\HL\{closure}()
  ./src/Glpi/Api/HL/Router.php:655                   Glpi\Api\HL\Router->doRequestMiddleware()
  ./src/Glpi/Controller/ApiController.php:96         Glpi\Api\HL\Router->handleRequest()
  ./vendor/symfony/http-kernel/HttpKernel.php:181    Glpi\Controller\ApiController->__invoke()
  ./vendor/symfony/http-kernel/HttpKernel.php:76     Symfony\Component\HttpKernel\HttpKernel->handleRaw()
  ./vendor/symfony/http-kernel/Kernel.php:197        Symfony\Component\HttpKernel\HttpKernel->handle()
  ./public/index.php:56                              Symfony\Component\HttpKernel\Kernel->handle()

glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/authorize?response_type=code&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&redirect_uri=%2Fapi.php%2Fswagger-oauth-redirect&scope=api&state=RnJpIEFwciAxOCAyMDI1IDE2OjIyOjI2IEdNVCswMjAwIChoZXVyZSBk4oCZw6l0w6kgZOKAmUV1cm9wZSBjZW50cmFsZSk%3D HTTP/1.1" 302 714 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:26 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:27 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:27 +0200] "GET /?redirect=http%3A%2F%2Fglpi11-wsl.lan%2Fapi.php%2Fv2%2Fauthorize%3Fscope%3Dapi%26client_id%3Df89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17%26response_type%3Dcode%26redirect_uri%3D%252Fapi.php%252Fswagger-oauth-redirect HTTP/1.1" 302 1616 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
glpi11-wsl.lan:80 127.0.0.1 - - [18/Apr/2025:16:22:27 +0200] "GET /api.php/v2/authorize?scope=api&client_id=f89b0c095db789eb916610e8196394bc0096337c4a3d4889abe698347f904e17&response_type=code&redirect_uri=/api.php/swagger-oauth-redirect HTTP/1.1" 302 713 "http://glpi11-wsl.lan/api.php/v2/doc" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
```

### Page URL

_No response_

### Steps To reproduce

_No response_

### Your GLPI setup information

<details><summary>GLPI information</summary><pre>GLPI: 11.0.0-dev ( => /opt/glpi/glpi11/versions/glpi)
Installation mode: TARBALL
Current language: fr_FR</pre></details><details><summary>Server</summary><pre>Operating system: Linux DESKTOP-KEVA 5.15.167.4-microsoft-standard-WSL2 #​1 SMP Tue Nov 5 00:21:55 UTC 2024 x86_64

PHP: 8.3.20 fpm-fcgi

PHP extensions: Core, date, libxml, openssl, pcre, zlib, filter, hash, json, random, Reflection, SPL, session, standard, sodium,
cgi-fcgi, mysqlnd, PDO, xml, apcu, bcmath, bz2, calendar, ctype, curl, dom, mbstring, FFI, fileinfo, ftp, gd, gettext, iconv,
imap, intl, ldap, exif, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm,
tokenizer, xmlreader, xmlrpc, xmlwriter, xsl, zip, Zend OPcache

Setup: max_execution_time="30" memory_limit="128M" post_max_size="8M" safe_mode="" session.save_handler="files"
upload_max_filesize="2M" disable_functions="" 

Web server: Apache/2.4.62 (Debian) (Apache/2.4.62 (Debian) Server at glpi11-wsl.lan Port 80)

User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0

Database:
   
Server Software: Debian 12
   
Server Version: 10.11.6-MariaDB-0+deb12u1-log
   
Server SQL Mode: STRICT_TRANS_TABLES,ERROR_FOR_DIVISION_BY_ZERO,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION
   
Parameters: glpi@127.0.0.1:3306/glpi11
   
Host info: 127.0.0.1 via TCP/IP

Requirements:
PHP version (8.3.20) is supported.
OS and PHP are relying on 64 bits integers.
Sessions configuration is OK.
Allocated memory is sufficient.
Following extensions are installed: dom, fileinfo, filter, libxml, json, simplexml, xmlreader, xmlwriter.
mysqli extension is installed.
curl extension is installed.
gd extension is installed.
intl extension is installed.
mbstring extension is installed.
zlib extension is installed.
bcmath extension is installed.
The constant
SODIUM_CRYPTO_AEAD_XCHACHA20POLY1305_IETF_NPUBBYTES is present.
openssl extension is installed.
Database engine version (10.11.6) is
supported.
No files from previous GLPI version detected.
The log file has been created successfully.
Write access to /opt/glpi/glpi11/files/_cache has been validated.
Write access to /opt/glpi/glpi11/files/_cron has been validated.
Write access to /opt/glpi/glpi11/files has been validated.
Write access to /opt/glpi/glpi11/files/_graphs has been validated.
Write access to /opt/glpi/glpi11/files/_lock has been validated.
Write access to /opt/glpi/glpi11/files/_pictures has been validated.
Write access to /opt/glpi/glpi11/files/_plugins has been validated.
Write access to /opt/glpi/glpi11/files/_rss has been validated.
Write access to /opt/glpi/glpi11/files/_sessions has been validated.
Write access to /opt/glpi/glpi11/files/_tmp has been validated.
Write access to /opt/glpi/glpi11/files/_uploads has been validated.

Sessions configuration is secured.
exif extension is installed.
ldap extension is installed.
openssl extension is installed.
Following extensions are installed: bz2,
Phar, zip.
Zend OPcache extension is installed.
Following extensions are installed:
ctype, iconv, sodium.
Write access to
/opt/glpi/glpi11/versions/glpi/plugins has been validated.
Timezones seems loaded in database.</pre></details><details><summary>GLPI constants</summary><pre>GLPI_ROOT: "/opt/glpi/glpi11/versions/glpi"
GLPI_VERSION: "11.0.0-dev"
GLPI_SCHEMA_VERSION: "11.0.0-dev@30aae2f1a8a216f13ed3674d32ae3b45b7cde98c"
GLPI_MIN_PHP: "8.2"
GLPI_MAX_PHP: "8.4"
GLPI_YEAR: "2025"
GLPI_I18N_DIR: "/opt/glpi/glpi11/versions/glpi/locales"
GLPI_CONFIG_DIR: "/opt/glpi/glpi11/config"
GLPI_MARKETPLACE_DIR: "/opt/glpi/glpi11/versions/glpi/plugins"
GLPI_VAR_DIR: "/opt/glpi/glpi11/files"
GLPI_DOC_DIR: "/opt/glpi/glpi11/files"
GLPI_CRON_DIR: "/opt/glpi/glpi11/files/_cron"
GLPI_DUMP_DIR: "/opt/glpi/glpi11/files/_dumps"
GLPI_GRAPH_DIR: "/opt/glpi/glpi11/files/_graphs"
GLPI_LOCK_DIR: "/opt/glpi/glpi11/files/_lock"
GLPI_PICTURE_DIR: "/opt/glpi/glpi11/files/_pictures"
GLPI_PLUGIN_DOC_DIR: "/opt/glpi/glpi11/files/_plugins"
GLPI_RSS_DIR: "/opt/glpi/glpi11/files/_rss"
GLPI_SESSION_DIR: "/opt/glpi/glpi11/files/_sessions"
GLPI_TMP_DIR: "/opt/glpi/glpi11/files/_tmp"
GLPI_UPLOAD_DIR: "/opt/glpi/glpi11/files/_uploads"
GLPI_CACHE_DIR: "/opt/glpi/glpi11/files/_cache"
GLPI_LOG_DIR: "/var/log/glpi/glpi11"
GLPI_ENVIRONMENT_TYPE: "production"
GLPI_ALLOW_IFRAME_IN_RICH_TEXT: false
GLPI_SERVERSIDE_URL_ALLOWLIST:
["#^http://[^@:]+(:80)?(/.*)?$#","#^https://[^@:]+(:443)?(/.*)?$#","#^feed://[^@:]+(/.*)?$#"]
GLPI_DISALLOWED_UPLOADS_PATTERN: "/\\.(php\\d*|phar)$/i"
GLPI_TELEMETRY_URI: "https://telemetry.glpi-project.org"
GLPI_INSTALL_MODE: "TARBALL"
GLPI_NETWORK_MAIL: "glpi@teclib.com"
GLPI_NETWORK_SERVICES: "https://services.glpi-network.com"
GLPI_MARKETPLACE_ENABLE: 3
GLPI_MARKETPLACE_PRERELEASES: true
GLPI_MARKETPLACE_ALLOW_OVERRIDE: true
GLPI_MARKETPLACE_MANUAL_DOWNLOADS: true
GLPI_USER_AGENT_EXTRA_COMMENTS: ""
GLPI_DOCUMENTATION_ROOT_URL: "https://links.glpi-project.org"
GLPI_DISABLE_ONLY_FULL_GROUP_BY_SQL_MODE: "1"
GLPI_AJAX_DASHBOARD: "1"
GLPI_CALDAV_IMPORT_STATE: 0
GLPI_CENTRAL_WARNINGS: "1"
GLPI_TEXT_MAXSIZE: "4000"
GLPI_WEBHOOK_ALLOW_RESPONSE_SAVING: "0"
GLPI_LOCAL_I18N_DIR: "/opt/glpi/glpi11/files/_locales"
GLPI_INVENTORY_DIR: "/opt/glpi/glpi11/files/_inventories"
GLPI_THEMES_DIR: "/opt/glpi/glpi11/files/_themes"
GLPI_NETWORK_REGISTRATION_API_URL: "https://services.glpi-network.com/api/registration/"
GLPI_MARKETPLACE_PLUGINS_API_URI: "https://services.glpi-network.com/api/marketplace/"</pre></details><details><summary>Libraries</summary><pre>symfony/mailer not found
simplepie/simplepie version 1.8.1 in /opt/glpi/glpi11/versions/glpi/vendor/simplepie/simplepie/src
tecnickcom/tcpdf version 6.9.0 in /opt/glpi/glpi11/versions/glpi/vendor/tecnickcom/tcpdf
tecnickcom/tc-lib-barcode version  in /opt/glpi/glpi11/versions/glpi/vendor/tecnickcom/tc-lib-barcode/src
sabre/dav version  in /opt/glpi/glpi11/versions/glpi/vendor/sabre/dav/lib/DAV
sabre/http version  in /opt/glpi/glpi11/versions/glpi/vendor/sabre/http/lib
sabre/uri version  in /opt/glpi/glpi11/versions/glpi/vendor/sabre/uri/lib
sabre/vobject version  in /opt/glpi/glpi11/versions/glpi/vendor/sabre/vobject/lib
laminas/laminas-i18n version  in /opt/glpi/glpi11/versions/glpi/vendor/laminas/laminas-i18n/src
monolog/monolog version  in /opt/glpi/glpi11/versions/glpi/vendor/monolog/monolog/src/Monolog
sebastian/diff version  in /opt/glpi/glpi11/versions/glpi/vendor/sebastian/diff/src
donatj/phpuseragentparser version  in /opt/glpi/glpi11/versions/glpi/vendor/donatj/phpuseragentparser/src/UserAgent
elvanto/litemoji version  in /opt/glpi/glpi11/versions/glpi/vendor/elvanto/litemoji/src
gettext/languages version  in /opt/glpi/glpi11/versions/glpi/vendor/gettext/languages/src
symfony/console version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/console
symfony/config version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/config/Loader
symfony/dependency-injection version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/dependency-injection
symfony/event-dispatcher version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/event-dispatcher
symfony/filesystem version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/filesystem
symfony/framework-bundle version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/framework-bundle
symfony/http-foundation version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/http-foundation
symfony/http-kernel version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/http-kernel
symfony/routing version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/routing
scssphp/scssphp version  in /opt/glpi/glpi11/versions/glpi/vendor/scssphp/scssphp/src
laminas/laminas-mail version  in /opt/glpi/glpi11/versions/glpi/vendor/laminas/laminas-mail/src/Protocol
laminas/laminas-mime version  in /opt/glpi/glpi11/versions/glpi/vendor/laminas/laminas-mime/src
rlanvin/php-rrule version  in /opt/glpi/glpi11/versions/glpi/vendor/rlanvin/php-rrule/src
ramsey/uuid version  in /opt/glpi/glpi11/versions/glpi/vendor/ramsey/uuid/src
phpoffice/phpspreadsheet version  in /opt/glpi/glpi11/versions/glpi/vendor/phpoffice/phpspreadsheet/src/PhpSpreadsheet
psr/log version  in /opt/glpi/glpi11/versions/glpi/vendor/psr/log/src
psr/simple-cache version  in /opt/glpi/glpi11/versions/glpi/vendor/psr/simple-cache/src
psr/cache version  in /opt/glpi/glpi11/versions/glpi/vendor/psr/cache/src
psr/container version  in /opt/glpi/glpi11/versions/glpi/vendor/psr/container/src
league/csv version  in /opt/glpi/glpi11/versions/glpi/vendor/league/csv/src
mexitek/phpcolors version  in /opt/glpi/glpi11/versions/glpi/vendor/mexitek/phpcolors/src/Mexitek/PHPColors
guzzlehttp/guzzle version  in /opt/glpi/glpi11/versions/glpi/vendor/guzzlehttp/guzzle/src
guzzlehttp/psr7 version  in /opt/glpi/glpi11/versions/glpi/vendor/guzzlehttp/psr7/src
glpi-project/inventory_format version  in /opt/glpi/glpi11/versions/glpi/vendor/glpi-project/inventory_format/lib/php
wapmorgan/unified-archive version  in /opt/glpi/glpi11/versions/glpi/vendor/wapmorgan/unified-archive/src
paragonie/sodium_compat version  in /opt/glpi/glpi11/versions/glpi/vendor/paragonie/sodium_compat/src
symfony/cache version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/cache
html2text/html2text version  in /opt/glpi/glpi11/versions/glpi/vendor/html2text/html2text/src
symfony/css-selector version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/css-selector
symfony/dom-crawler version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/dom-crawler
twig/twig version  in /opt/glpi/glpi11/versions/glpi/vendor/twig/twig/src
twig/string-extra version  in /opt/glpi/glpi11/versions/glpi/vendor/twig/string-extra
symfony/polyfill-ctype not found
symfony/polyfill-iconv not found
symfony/polyfill-mbstring not found
symfony/polyfill-php83 not found
league/oauth2-client version  in /opt/glpi/glpi11/versions/glpi/vendor/league/oauth2-client/src/Provider
league/oauth2-google version  in /opt/glpi/glpi11/versions/glpi/vendor/league/oauth2-google/src/Provider
thenetworg/oauth2-azure version  in /opt/glpi/glpi11/versions/glpi/vendor/thenetworg/oauth2-azure/src/Provider
league/commonmark version  in /opt/glpi/glpi11/versions/glpi/vendor/league/commonmark/src/Extension/CommonMark
egulias/email-validator version  in /opt/glpi/glpi11/versions/glpi/vendor/egulias/email-validator/src
symfony/mime not found
apereo/phpcas version  in /opt/glpi/glpi11/versions/glpi/vendor/apereo/phpcas/source
bacon/bacon-qr-code version  in /opt/glpi/glpi11/versions/glpi/vendor/bacon/bacon-qr-code/src
robthree/twofactorauth version  in /opt/glpi/glpi11/versions/glpi/vendor/robthree/twofactorauth/lib
ralouphie/getallheaders not found
symfony/html-sanitizer version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/html-sanitizer
league/oauth2-server version  in /opt/glpi/glpi11/versions/glpi/vendor/league/oauth2-server/src
league/html-to-markdown version  in /opt/glpi/glpi11/versions/glpi/vendor/league/html-to-markdown/src
twig/markdown-extra version  in /opt/glpi/glpi11/versions/glpi/vendor/twig/markdown-extra
webonyx/graphql-php version  in /opt/glpi/glpi11/versions/glpi/vendor/webonyx/graphql-php/src
phpdocumentor/reflection-docblock version  in /opt/glpi/glpi11/versions/glpi/vendor/phpdocumentor/reflection-docblock/src
symfony/property-access version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/property-access
symfony/serializer version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/serializer
symfony/property-info version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/property-info
symfony/error-handler version  in /opt/glpi/glpi11/versions/glpi/vendor/symfony/error-handler</pre></details><details><summary>Réplicats SQL</summary><pre>Not active</pre></details><details><summary>Notifications</summary><pre>Way of sending emails: PHP</pre></details>

### Anything else?

_No response_


Discussion: The diff to fix this seems pretty simple:
```diff --git a/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php b/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php
index 46c18d8cdf6..1921fc756d1 100644
--- a/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php
+++ b/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php
@@ -41,18 +41,16 @@ class CookieAuthMiddleware extends AbstractMiddleware implements AuthMiddlewareI
 {
     public function process(MiddlewareInput $input, callable $next): void
     {
-        $auth = new \Auth();
-        if ($auth->getAlternateAuthSystemsUserLogin(\Auth::COOKIE)) {
-            // User could be authenticated by a cookie
-            // Need to use cookies for session and start it manually
-            ini_set('session.use_cookies', '1');
-            Session::start();
+        ini_set('session.use_cookies', '1');
+        Session::start();
+
+        if (($user_id = Session::getLoginUserID()) !== false) {
             // unset the response to indicate a successful auth
             $input->response = null;
             $input->client = [
                 'client_id' => 'internal', // Internal just means the user was authenticated internally either by cookie or an already existing session.
-                'users_id'  => Session::getLoginUserID(),
-                'scopes' => []
+                'users_id'  => $user_id,
+                'scopes'    => [],
             ];
         } else {
             $next($input);
```

However, it breaks the test suite, and it requires a new test to be implemented.

There is a known issue with this requiring the Rember Me feature. See #18299. Can you check if the Remember Me feature is enabled and selected during the GLPI login, and if not, if having it enabled resolves the issue?
Hello @cconard96,

The "Remember Me" feature is enabled:

![Image](https://github.com/user-attachments/assets/4ae66b42-10f7-4c5b-af90-db95f816b5ac)

I tried applying the patch, but the same error still occurs.



Fix (patch):
diff --git a/install/empty_data.php b/install/empty_data.php
index 04509bb2fa9..ef8651cced2 100644
--- a/install/empty_data.php
+++ b/install/empty_data.php
@@ -39,6 +39,8 @@
 use Glpi\RichText\UserMention;
 use Glpi\Socket;
 
+use function Safe\json_encode;
+
 // Use anonymous class so we can have constants that define special values without polluting the global table
 // and adding unnecessary variables to IDE autocomplete data that may result in errors
 $empty_data_builder = new class {
@@ -9522,6 +9524,17 @@ public function getEmptyData(): array
                 'is_recursive' => 1,
                 'is_dynamic' => 0,
             ];
+
+            $tables['glpi_oauthclients'][] = [
+                'name' => 'Test E2E OAuth Client',
+                'redirect_uri' => json_encode(["/api.php/oauth2/redirection"]),
+                'grants' => json_encode(['authorization_code']),
+                'scopes' => json_encode(['api', 'user']),
+                'is_active' => 1,
+                'is_confidential' => 1,
+                'identifier' => '9246d35072ff62193330003a8106d947fafe5ac036d11a51ebc7ca11b9bc135e',
+                'secret' => (new GLPIKey())->encrypt('d2c4f3b8a0e1f7b5c6a9d1e4f3b8a0e1f7b5c6a9d1e4f3b8a0e1f7b5c6a9d1'),
+            ];
         }
 
         return $tables;
diff --git a/phpunit/functional/Glpi/Api/HL/Controller/CoreControllerTest.php b/phpunit/functional/Glpi/Api/HL/Controller/CoreControllerTest.php
index 814826538c8..3eb4b317c04 100644
--- a/phpunit/functional/Glpi/Api/HL/Controller/CoreControllerTest.php
+++ b/phpunit/functional/Glpi/Api/HL/Controller/CoreControllerTest.php
@@ -320,55 +320,6 @@ public function testOAuthPasswordGrantHeader()
         });
     }
 
-    public function testOAuthAuthCodeGrant()
-    {
-        // Not a complete end to end test. Not sure how that could be done. Should probably be using Cypress.
-        global $DB;
-
-        // Create an OAuth client
-        $client = new \OAuthClient();
-        $client_id = $client->add([
-            'name' => __FUNCTION__,
-            'is_active' => 1,
-            'is_confidential' => 1,
-        ]);
-        $this->assertGreaterThan(0, $client_id);
-
-        $client->update([
-            'id' => $client_id,
-            'grants' => ['authorization_code'],
-            'redirect_uri' => ["/api.php/oauth2/redirection"],
-        ]);
-
-        // get client ID and secret
-        $it = $DB->request([
-            'SELECT' => ['identifier', 'secret', 'redirect_uri'],
-            'FROM' => \OAuthClient::getTable(),
-            'WHERE' => ['id' => $client_id],
-        ]);
-        $this->assertCount(1, $it);
-        $client_data = $it->current();
-
-        // Test authorize endpoint
-        $request = new Request('GET', '/Authorize', [], null);
-        $request = $request->withQueryParams([
-            'response_type' => 'code',
-            'client_id' => $client_data['identifier'],
-            'scope' => '',
-            'redirect_uri' => json_decode($client_data['redirect_uri'])[0],
-        ]);
-
-        $this->api->call($request, function ($call) {
-            /** @var \HLAPICallAsserter $call */
-            $call->response
-                ->status(fn($status) => $this->assertEquals(302, $status))
-                ->headers(function ($headers) {
-                    global $CFG_GLPI;
-                    $this->assertMatchesRegularExpression('/^' . preg_quote($CFG_GLPI['url_base'], '/') . '\/\?redirect=/', $headers['Location']);
-                });
-        });
-    }
-
     public function testOAuthClientCredentialsGrant(): void
     {
         global $DB;
diff --git a/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php b/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php
index 9025c523962..0344b74c474 100644
--- a/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php
+++ b/src/Glpi/Api/HL/Middleware/CookieAuthMiddleware.php
@@ -41,17 +41,17 @@ class CookieAuthMiddleware extends AbstractMiddleware implements AuthMiddlewareI
 {
     public function process(MiddlewareInput $input, callable $next): void
     {
-        $auth = new \Auth();
-        if ($auth->getAlternateAuthSystemsUserLogin(\Auth::COOKIE)) {
-            // User could be authenticated by a cookie
-            // Need to use cookies for session and start it manually
-            ini_set('session.use_cookies', '1');
-            Session::start();
+        // User could be authenticated by a cookie
+        // Need to use cookies for session and start it manually
+        ini_set('session.use_cookies', '1');
+        Session::start();
+
+        if (($user_id = Session::getLoginUserID()) !== false) {
             // unset the response to indicate a successful auth
             $input->response = null;
             $input->client = [
                 'client_id' => 'internal', // Internal just means the user was authenticated internally either by cookie or an already existing session.
-                'users_id'  => Session::getLoginUserID(),
+                'users_id'  => $user_id,
                 'scopes' => [],
             ];
         } else {
diff --git a/src/Glpi/Api/HL/Middleware/IPRestrictionRequestMiddleware.php b/src/Glpi/Api/HL/Middleware/IPRestrictionRequestMiddleware.php
index b68f9b175c4..da916d5dacd 100644
--- a/src/Glpi/Api/HL/Middleware/IPRestrictionRequestMiddleware.php
+++ b/src/Glpi/Api/HL/Middleware/IPRestrictionRequestMiddleware.php
@@ -53,13 +53,14 @@ public function process(MiddlewareInput $input, callable $next): void
 
         $request_ip = $_SERVER['REMOTE_ADDR'];
 
-        $allowed_ips = $DB->request([
+        $result = $DB->request([
             'SELECT' => ['allowed_ips'],
             'FROM'   => 'glpi_oauthclients',
             'WHERE'  => [
                 'identifier' => $client['client_id'],
             ],
-        ])->current()['allowed_ips'];
+        ])->current();
+        $allowed_ips = $result['allowed_ips'] ?? [];
 
         if (empty($allowed_ips)) {
             // No IP restriction
diff --git a/src/Glpi/Kernel/Listener/PostBootListener/SessionStart.php b/src/Glpi/Kernel/Listener/PostBootListener/SessionStart.php
index 0ee8d59ba66..5f811526d70 100644
--- a/src/Glpi/Kernel/Listener/PostBootListener/SessionStart.php
+++ b/src/Glpi/Kernel/Listener/PostBootListener/SessionStart.php
@@ -66,6 +66,17 @@ public static function getSubscribedEvents(): array
 
     public function onPostBoot(): void
     {
+        // Always set the session files path, even when session is not started automatically here.
+        // It can indeed be started later manually and the path must be correctly set when it is done.
+        if (Session::canWriteSessionFiles()) {
+            Session::setPath();
+        } else {
+            \trigger_error(
+                sprintf('Unable to write session files on `%s`.', GLPI_SESSION_DIR),
+                E_USER_WARNING
+            );
+        }
+
         // The session must be started even in CLI context.
         // The GLPI code refers to the session in many places
         // and we cannot safely remove its initialization in the CLI context.
@@ -120,15 +131,6 @@ public function onPostBoot(): void
         }
 
         if ($start_session) {
-            if (Session::canWriteSessionFiles()) {
-                Session::setPath();
-            } else {
-                \trigger_error(
-                    sprintf('Unable to write session files on `%s`.', GLPI_SESSION_DIR),
-                    E_USER_WARNING
-                );
-            }
-
             Session::start();
         }
     }