<p dir="auto"><em>(this issue is part of the <a href="http://symfony.com/blog/making-the-symfony-experience-exceptional" rel="nofollow">"DX" ("Developer eXperience") initiative</a> introduced by Symfony project)</em></p>
<h2 dir="auto">The problem</h2>
<p dir="auto">When using the HttpCache for your Symfony application, its cache size grows up to the infinite. This means that from time to time you must manually clear the contents of the HTTP cache or you'll end up without free disk space.</p>
<h2 dir="auto">The solution</h2>
<p dir="auto">I've found at least three past attempts to solve this problem: <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="5567424" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/4871" data-hovercard-type="issue" data-hovercard-url="/symfony/symfony/issues/4871/hovercard" href="https://github.com/symfony/symfony/issues/4871">#4871</a>, <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="9058105" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/6213" data-hovercard-type="pull_request" data-hovercard-url="/symfony/symfony/pull/6213/hovercard" href="https://github.com/symfony/symfony/pull/6213">#6213</a> and <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="10242090" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/6855" data-hovercard-type="pull_request" data-hovercard-url="/symfony/symfony/pull/6855/hovercard" href="https://github.com/symfony/symfony/pull/6855">#6855</a>. We should decide which one of those proposals is the best one and finish all the pending work.</p>
<p dir="auto"><strong>Symfony version(s) affected</strong>: 4.1.3</p>
<p dir="auto"><strong>Description</strong></p>
<p dir="auto">When using "Remember me" functionality, session is regenerated with every request. Due to concurrent requests done by browser session is effectively lost which leads to e.g. CSRF token mismatch.</p>
<p dir="auto">Authentication is kept, user is still logged in (because of Remember me), but the session is lost.</p>
<p dir="auto">In <code class="notranslate">\Symfony\Component\Security\Http\Firewall\RememberMeListener::handle:87</code> following method is called <code class="notranslate">\Symfony\Component\Security\Http\Session\SessionAuthenticationStrategy::onAuthentication</code>. With default session strategy <code class="notranslate">migrate</code> it leads to calling <code class="notranslate">session_regenerate_id($destroy = true)</code> in every request. Session ID is changed A-&gt;B with main request. For other requests done by browser session ID is B, but changed B-&gt;C, B-&gt;D etc.</p>
<p dir="auto"><strong>How to reproduce</strong></p>
<ul dir="auto">
<li>use "Remember me" functionality</li>
<li>login e.g using form</li>
<li>make HTTP request, which makes browser request other resources responded by controller (not assets)</li>
<li>you can check session ID changes every request and Cookie/Set-Cookie HTTP headers is set sent accordingly.</li>
</ul>
<p dir="auto">fragment from <code class="notranslate">config/packages/security.yaml</code></p>
<div class="snippet-clipboard-content notranslate position-relative overflow-auto" data-snippet-clipboard-copy-content="            remember_me:
                secret: '%kernel.secret%'
                lifetime: 34128000
                #                secure: true
                always_remember_me: true
                user_provider: entity.user_account.email"><pre class="notranslate"><code class="notranslate">            remember_me:
                secret: '%kernel.secret%'
                lifetime: 34128000
                #                secure: true
                always_remember_me: true
                user_provider: entity.user_account.email
</code></pre></div>
<p dir="auto"><strong>Possible Solution</strong></p>
<ul dir="auto">
<li>set strategy to <code class="notranslate">none</code> (probably not safe) or</li>
<li>authenticate user in RememberMeListener only if not already authenticated (according to <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="327756273" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/27427" data-hovercard-type="pull_request" data-hovercard-url="/symfony/symfony/pull/27427/hovercard?comment_id=393517706&amp;comment_type=issue_comment" href="https://github.com/symfony/symfony/pull/27427#issuecomment-393517706">#27427 (comment)</a>)</li>
</ul>
<p dir="auto"><strong>Additional context</strong></p>
<ul dir="auto">
<li><a href="https://gist.github.com/darnel/d7a269c34de0aeb4ddd4eee7175abd76">full security.yml configuration</a></li>
<li>might be related to <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="333724644" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/27640" data-hovercard-type="issue" data-hovercard-url="/symfony/symfony/issues/27640/hovercard" href="https://github.com/symfony/symfony/issues/27640">#27640</a></li>
<li>bug report is opposite to <a class="issue-link js-issue-link" data-error-text="Failed to load title" data-id="106021833" data-permission-text="Title is private" data-url="https://github.com/symfony/symfony/issues/15764" data-hovercard-type="issue" data-hovercard-url="/symfony/symfony/issues/15764/hovercard" href="https://github.com/symfony/symfony/issues/15764">#15764</a> :-D</li>
</ul>