From 1758807bcedcfdf8ba576f6f8ae9c201741038f4 Mon Sep 17 00:00:00 2001
From: tomatlscomm <tom@lightsaber-communication.com>
Date: Thu, 8 Jan 2026 16:10:10 +0100
Subject: [PATCH 1/2] Bug: Remember-me token refresh fails in loginView() -
 missing ->withCookies() on redirect #1305

---
 src/Controllers/LoginController.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Controllers/LoginController.php b/src/Controllers/LoginController.php
index 8c07f8b75..4d42b74c6 100644
--- a/src/Controllers/LoginController.php
+++ b/src/Controllers/LoginController.php
@@ -31,7 +31,7 @@ class LoginController extends BaseController
     public function loginView()
     {
         if (auth()->loggedIn()) {
-            return redirect()->to(config('Auth')->loginRedirect());
+            return redirect()->to(config('Auth')->loginRedirect())->withCookies();
         }
 
         /** @var Session $authenticator */

From 3b327d54e11fc0377200edabee1cae80e1733a72 Mon Sep 17 00:00:00 2001
From: michalsn <michal@sniatala.pl>
Date: Wed, 22 Jul 2026 14:38:25 +0200
Subject: [PATCH 2/2] test: cover remember-me cookie refresh redirect

---
 phpstan-baseline.php            |  6 ++++++
 tests/Controllers/LoginTest.php | 30 ++++++++++++++++++++++++++++++
 2 files changed, 36 insertions(+)

diff --git a/phpstan-baseline.php b/phpstan-baseline.php
index 8f7fd4fac..1cf96992f 100644
--- a/phpstan-baseline.php
+++ b/phpstan-baseline.php
@@ -331,6 +331,12 @@
 	'count' => 1,
 	'path' => __DIR__ . '/tests/Controllers/ActionsTest.php',
 ];
+$ignoreErrors[] = [
+	'rawMessage' => 'Call to method setCookie() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
+	'identifier' => 'method.internalClass',
+	'count' => 1,
+	'path' => __DIR__ . '/tests/Controllers/LoginTest.php',
+];
 $ignoreErrors[] = [
 	'rawMessage' => 'Call to method setServer() of internal class CodeIgniter\\Superglobals from outside its root namespace CodeIgniter.',
 	'identifier' => 'method.internalClass',
diff --git a/tests/Controllers/LoginTest.php b/tests/Controllers/LoginTest.php
index 09de25823..bc0851406 100644
--- a/tests/Controllers/LoginTest.php
+++ b/tests/Controllers/LoginTest.php
@@ -17,6 +17,7 @@
 use CodeIgniter\I18n\Time;
 use CodeIgniter\Shield\Authentication\Actions\Email2FA;
 use CodeIgniter\Shield\Config\Auth;
+use CodeIgniter\Shield\Models\RememberModel;
 use CodeIgniter\Shield\Models\UserIdentityModel;
 use CodeIgniter\Test\FeatureTestTrait;
 use CodeIgniter\Test\TestResponse;
@@ -169,6 +170,35 @@ public function testAfterLoggedInNotDisplayLoginPage(): void
         $result->assertRedirectTo(config('Auth')->loginRedirect());
     }
 
+    public function testAfterLoggedInWithRememberCookieReturnsRefreshedCookie(): void
+    {
+        $this->user->createEmailIdentity([
+            'email'    => 'foo@example.com',
+            'password' => 'secret123',
+        ]);
+
+        $selector  = 'selector';
+        $validator = 'validator';
+        $expires   = Time::now()
+            ->addSeconds(setting('Auth.sessionConfig')['rememberLength'])
+            ->format('Y-m-d H:i:s');
+
+        model(RememberModel::class)->rememberUser(
+            $this->user,
+            $selector,
+            hash('sha256', $validator),
+            $expires,
+        );
+
+        $cookieName = setting('Auth.sessionConfig')['rememberCookieName'];
+        service('superglobals')->setCookie($cookieName, $selector . ':' . $validator);
+
+        $result = $this->get('/login');
+
+        $result->assertRedirectTo(config('Auth')->loginRedirect());
+        $result->assertCookie($cookieName);
+    }
+
     public function testLoginActionUsernameSuccess(): void
     {
         Time::setTestNow('March 10, 2017', 'UTC');