milesj/cake-auto_login — Issue #12: Auth->login()
Author: mcallisto
Created: 2011-12-10 11:59:56+00:00
State: open

Hi miles,

I am testing your 2.0 version and it seems to me there is something to be better analyzed, I will share some temporary idea.

When you startup() method tries to login the user with the data stored in the cookie, it uses

if ($this->Auth->login($cookie)) {

I'm quite sure this is not working, see the book
http://book.cakephp.org/2.0/en/core-libraries/components/authentication.html
where it says:
> **WARNING**:
> *In 2.0 $this->Auth->login($this->request->data) will log the user in with whatever data is posted,*
> *whereas in 1.3 $this->Auth->login($this->data) would try to identify the user first and only log in when successful.*

So I made it working changing the code into something like:

$controller->request->data['User'] = array(
'username' => $cookie['username'],
'password' => 'banana' // test password before hashing
);

if ($this->Auth->login()) {

simulating a POST request from the user with the login data.

Problem is that the password from the cookie contained in $cookie['password'] is hashed and won't work for login...

I'll keep thinking about it and come back.