Settings
Demo only: this project has no accounts, so the
settings nav below is filtered against a pretend role instead of a
real one. You are currently viewing this as
an administrator.
The MFA interaction that's easy to get wrong: when
someone returns via a remembered session, Symfony restores a
RememberMeToken directly rather than replaying the
original sign-in - a two-factor check that only wraps specific
token classes can silently never fire for a "remembered" visitor.
Any project turning this pattern into a real
remember_me firewall must add
RememberMeToken to its 2FA bundle's own token list, or
give "skip my second factor" its own separate, shorter-lived,
revocable grant (scheb/2fa's trusted-device feature) - see the
remember-me skill in full before wiring this up for
real. A stolen remember-me cookie must never be enough on its own
to bypass MFA for an admin account.