Update (29/04/2008): This feature has been improved and packed as a component! Read about it here.

Update (03/07/2008): And again of course: remember me component - the final word

After reading A Hopefully Useful Tutorial For Using CakePHP’s Auth Component and the follow-up, it became apparent that this should be an easy thing to do. And it really is.

I've reused the code from the above links to write the cookie after user login. I'm assuming you have a UsersController with login and logout actions.

class UsersController extends AppController
{
    // your other stuff here..

    function login()
    {
        if ($this->Auth->user())
        {
            if (!empty($this->data))
            {
                if (empty($this->data['User']['remember_me']))
                {
                    $this->Cookie->del('User');
                }
                else
                {
                    $cookie = array();
                    $cookie['username'] = $this->data['User']['username'];
                    $cookie['token']    = $this->data['User']['password'];
                    $this->Cookie->write('User', $cookie, true, '+2 weeks');
                }

                unset($this->data['User']['remember_me']);
            }
            
            $this->redirect($this->Auth->redirect());
        }
    }

    function logout()
    {
        $this->Cookie->del('User');
        $this->redirect($this->Auth->logout());
    }
}

In your model, you can define the following function:

class User extends AppModel
{
    var $name = 'User';

    // your other stuff here..

    function checkLogin($username, $passhash)
    {
        $user = $this->find(array('username' => $username, 'password' => $passhash), array(), null, 0);

        if ($user)
        {
            $this->data = $user;
            $this->id = $user['User']['id'];
            return true;
        }

        return false;
    }
}

Now you have everything ready for the final piece of code. In your AppController, write the following beforeFilter() code:

class AppController extends Controller
{
    var $components = array('Auth', 'Cookie');
    var $uses = array('User');

    function beforeFilter()
    {
        Security::setHash('md5');

        $this->Auth->loginAction    = array('controller' => 'users', 'action' => 'login');
        $this->Auth->logoutRedirect = '/';
        $this->Auth->loginError     = 'Wrong username / password combination';
        $this->Auth->authError      = 'You must be logged in before you try to do that';
        $this->Auth->authorize      = 'controller';
        $this->Auth->autoRedirect   = false;

        $cookie = $this->Cookie->read('User');

        if (is_array($cookie) && !$this->Auth->user())
        {
            if ($this->User->checkLogin($cookie['username'], $cookie['token']))
                if (!$this->Auth->login($this->User))
                    $this->Cookie->del('User');
        }
    }
}

And you're done! This should auto-login any valid user before any action is taken.

There's a price of course, a slight overhead of reading a cookie and calling $this->Auth->user() on each request, but it's not horrible enough for me to avoid it. At least not yet :-)

Happy baking!