RememberMeServicesInterface::autoLogin()

This method will be called whenever the TokenStorage does not contain a TokenInterface object and the framework wishes to provide an implementation with an opportunity to authenticate the request using remember-me capabilities.

No attempt whatsoever is made to determine whether the browser has requested remember-me services or presented a valid cookie. Any and all such determinations are left to the implementation of this method.

If a browser has presented an unauthorised cookie for whatever reason, make sure to throw an AuthenticationException as this will consequentially result in a call to loginFail() and therefore an invalidation of the cookie.