Counting number of successful logins

[thomaspapanikolaou]

Hi everyone,

Context

I would like to implement functionality to show the number of successful logins in my app. It is one of the engagement metrics my customers requested.

Challenge

Using existing Shield functionality (auth_logins table), this is straight forward for the cases where username/password, email/password and magic login was used to login.

The same cannot be said for counting logins of users that chose to stay logged-in by selecting rememberme. Or I have not found an elegant way to do it.

Preliminary thoughts

The reason seems to be that Shield will call Events::trigger('login', $user); on successful login in the first case, but there is no corresponding Events::trigger('rememberMeLogin', $user); in the second case.

For a first pass through the Session.php code, it seems that adding one line in the following implementation, would do the trick.

    /**
     * @return bool true if logged in by remember-me token.
     */
    private function checkRememberMe(): bool
    {
        // Get remember-me token.
        $remember = $this->getRememberMeToken();
        if ($remember === null) {
            $this->userState = self::STATE_ANONYMOUS;

            return false;
        }

        // Check the remember-me token.
        $token = $this->checkRememberMeToken($remember);
        if ($token === false) {
            $this->userState = self::STATE_ANONYMOUS;

            return false;
        }

        $user = $this->provider->findById($token->user_id);

        if ($user === null) {
            // The user is deleted.
            $this->userState = self::STATE_ANONYMOUS;

            // Remove remember-me cookie.
            $this->removeRememberCookie();

            return false;
        }

        $this->startLogin($user);

        $this->refreshRememberMeToken($token);

        // a successful rememberMe login; trigger event
        Events::trigger('rememberMeLogin', $user);

        $this->userState = self::STATE_LOGGED_IN;

        return true;
    } 

Why do I think this would work

1. it follows the architectural principle of triggering an event on major auth functions.
2. like the register, login, failedLogin, logout, magicLogin events, it adds flexibility for developer code to tap into.
3. it is the only one missing

Your help

Before I proceed, I would like to share this here and ask for your advice, to avoid going through a potential rabbit hole!

All comments welcome.

Thomas

[thomaspapanikolaou]

@kenjis @datamweb looping you in for visibility.

[datamweb]

If you have the time, it would be great if you could investigate how other frameworks handle this behavior, especially regarding whether a remember-me login is treated as a real login in their authentication flow. Please share the results of your research here and tag me when you do — I’d be happy to review it together.

[grimpirate]

This doesn't sound like you want to count successful logins. Remember Me is a feature that maintains the session, which is to say the user never logged out, and thusly, never logged back in. What you're wanting to count sounds like active users or active sessions. That's something you could implement at the BaseController level or perhaps a Filter so that it happens on every request to your application. Even then this would be an estimate as you would have to define a certain period of time from when a request was issued to consider a user "active" on the site.