Complex if statements in authentication method
Two suggestions on how to keep this code maintainable:


use early exits
keep conditions atomic (one if checks for one thing) 


Example:

function findLoggedInUser()
{
    if (($userData = $this-&gt;httpSession-&gt;getParameter('user')) &amp;&amp; isset($userData['id'])) {
        // User found in current http session
        return $this-&gt;userMapper-&gt;findById($userData['id']);
    }

    $httpSessionData = $this-&gt;httpCookie-&gt;getParameter('usess');
    if(!$httpSessionData) {
        $this-&gt;httpCookie-&gt;destroy('usess');
        return null;
    }

    if(!isset($httpSessionData['uid'], $httpSessionData['sno'], $httpSessionData['token'])) {
        $this-&gt;httpCookie-&gt;destroy('usess');
        return null;
    }

    $user = $this-&gt;userMapper-&gt;findById($httpSessionData['uid']);
    if(!$user) {
        $this-&gt;httpCookie-&gt;destroy('usess');
        return null;
    }

    $httpSession = $this-&gt;httpSessionMapper-&gt;findByUserAndSeriesNo($user, $httpSessionData['sno']));
    if(!$httpSessionData) {
        $this-&gt;httpCookie-&gt;destroy('usess');
        return null;
    }

    if (!password_verify($httpSessionData['token'], (string) $httpSession-&gt;getTokenHash()) {
        $this-&gt;httpSessionMapper-&gt;deleteAllByUser($user);
        $this-&gt;httpCookie-&gt;destroy('usess');
        return null;
    }

    // EVERYTHING'S FINE, DO THE JOB

    // Generate new http session entity tokens
    $token['raw']  = new Token(CryptoCharGen::numeric(60));
    $token['hash'] = new TokenHash(password_hash((string) $token['raw'], PASSWORD_BCRYPT, ['cost' =&gt; 4]));

    // Update and persist http session entity with new token
    $httpSession-&gt;setTokenHash($token['hash']);

    $this-&gt;httpSessionMapper-&gt;update($httpSession);

    // Issue new http cookie usess with updated http session recovery data
    $this-&gt;httpCookie-&gt;setParameter('usess', [
        'uid'   =&gt; (string) $httpSession-&gt;getUser()-&gt;getId(),
    'sno'   =&gt; (string) $httpSession-&gt;getSeriesNo(),
    'token' =&gt; (string) $token['raw']
        ], 60 * 60 * 24 * 90);

    // User has been found
    return $httpSession-&gt;getUser();
}


This way, the code remains readable and flexible for future modifications.