Hi,

I have made a custom auth driver base on the documentation, but as I check my database and used var_dump to see what happens internally, it seems that Auth::attempt makes more than one effort to set a remember_me token. here is the output of the var_dump, it shows the path Auth::attempt goes: (OUser is extended from GenericUser and OUserProvider is an implementation of UserProviderInterface used in Auth::extend)

string 'OUserProvider.retrieveByCredentials' (length=35)
string 'OUserProvider.validateCredentials' (length=33)
string 'OUser.getAuthIdentifier' (length=23)
string 'OUser.getAuthIdentifier' (length=23)
string 'OUser.getRememberToken' (length=22)
string 'OUser.getAuthIdentifier' (length=23)
string 'OUser.setRememberToken' (length=22)
string 'OUser.getAuthIdentifier' (length=23)
string 'OUserProvider.updateRememberToken' (length=33)
string 'OUser.getAuthIdentifier' (length=23)
string 'OUser.getAuthIdentifier' (length=23)
string 'OUser.getRememberToken' (length=22)
string 'OUser.getAuthIdentifier' (length=23)
boolean true

There are clearly two calls to the methods responsible to setting/updating a remember_me token, one is OUser.setRememberToken and the other is OUserProvider.updateRememberToken.

In my custom driver, both do the same thing as their name suggest and that leads to inserting two tokens (one valid and the other expired as my code logic suggests, and I don't update anything, I do insert and update previous entry's status). I'm sure that I didn't fully understand this process. I'd be glad if someone can help me and clarify the difference between these two.

Thanks!