Implementing "Remember Me" Login in Laravel

A normal Laravel session ends when the browser session cookie expires or the user closes the browser (depending on session configuration) — "remember me" is what keeps a user logged in across a longer stretch of time, including full browser restarts, without asking them to log in again.

1. The basic implementation

Auth::attempt(
    ['email' => $request->email, 'password' => $request->password],
    $request->boolean('remember') // true if the "remember me" checkbox was checked
);

That third argument is the entire feature from the application code's perspective — Laravel's authentication system handles everything else (issuing the long-lived cookie, validating it on later visits) internally once this flag is set to true.

2. What actually happens behind that flag

When remember is true, Laravel generates a long, random token, stores it in the remember_token column on the users table, and sets a separate, long-lived (default: 5 years) encrypted cookie containing that token alongside the user's ID. On a later visit, if the normal session has expired but this cookie is present and its token matches the database column, Laravel automatically re-authenticates the user without requiring credentials again.

3. The remember_token column is required

Laravel's default users migration already includes a remember_token column — but any custom user table or a heavily modified migration needs to keep it (a nullable, 100-character string column) for "remember me" to function at all. Without it, the remember flag is silently ignored rather than throwing an obvious error.

4. Logging out invalidates the remember token too

Auth::logout();

A standard logout call regenerates the remember_token in the database, which invalidates the cookie's stored token immediately — this matters because it means "remember me" doesn't create a security gap where logging out on one device leaves other devices' remember-me cookies still valid; logging out anywhere invalidates the token everywhere.

5. Checking whether the current session came from a remember cookie

if (Auth::viaRemember()) {
    // the current authentication came from the remember-me cookie,
    // not a fresh login with credentials this session
}

This is useful for gating especially sensitive actions (changing a password, viewing billing details) behind a fresh credential check, even for an already-"logged in" user, if their session was restored purely from a long-lived remember cookie rather than an actual recent login.

6. It's a convenience feature, not a substitute for session security

A "remember me" cookie is still just a credential, stored in the browser — on a shared or public computer, checking that box leaves the account accessible to whoever uses that browser next, for as long as the cookie remains valid. This is worth surfacing to users via UI copy ("don't check this on a shared computer") rather than assuming it's a purely cosmetic convenience option.