src/Web/User.php
protected function renewAuthStatus()
    {
        $session = $this->app->session;
        $id = $session->getHasSessionId() || $session->getIsActive() ? $session->get($this->idParam) : null;

        if ($id === null) {
            $identityPromise = resolve(null);
        } else {
            /* @var $class IdentityInterface */
            $class = $this->identityClass;
            $identityPromise = $class::findIdentity($id);
        }

        return $identityPromise
            ->then(function($identity) use ($session) {
                /** @var IdentityInterface $identity */
                $this->setIdentity($identity);

                $logoutPromise = resolve(true);
                if ($identity !== null && ($this->authTimeout !== null || $this->absoluteAuthTimeout !== null)) {
                    $expire = $this->authTimeout !== null ? $session->get($this->authTimeoutParam) : null;
                    $expireAbsolute = $this->absoluteAuthTimeout !== null ? $session->get($this->absoluteAuthTimeoutParam) : null;
                    if ($expire !== null && $expire < time() || $expireAbsolute !== null && $expireAbsolute < time()) {
                        $logoutPromise = $this->logout(false);
                    } elseif ($this->authTimeout !== null) {
                        $session->set($this->authTimeoutParam, time() + $this->authTimeout);
                    }
                }

                return $logoutPromise->then(function() {
                    if ($this->enableAutoLogin) {
                        if ($this->getIsGuest()) {
                            return $this->loginByCookie();
                        } elseif ($this->autoRenewCookie) {
                            $this->renewIdentityCookie();
                        }
                    }
                    return true;
                });
            });
    }
protected function renewAuthStatus()
    {
        $session = $this->app->session;
        $id = $session->getHasSessionId() || $session->getIsActive() ? $session->get($this->idParam) : null;

        if ($id === null) {
            $identityPromise = resolve(null);
        } else {
            /* @var $class IdentityInterface */
            $class = $this->identityClass;
            $identityPromise = $class::findIdentity($id);
        }

        return $identityPromise
            ->then(function($identity) use ($session) {
                /** @var IdentityInterface $identity */
                $this->setIdentity($identity);

                $logoutPromise = resolve(true);
                if ($identity !== null && ($this->authTimeout !== null || $this->absoluteAuthTimeout !== null)) {
                    $expire = $this->authTimeout !== null ? $session->get($this->authTimeoutParam) : null;
                    $expireAbsolute = $this->absoluteAuthTimeout !== null ? $session->get($this->absoluteAuthTimeoutParam) : null;
                    if ($expire !== null && $expire < time() || $expireAbsolute !== null && $expireAbsolute < time()) {
                        $logoutPromise = $this->logout(false);
                    } elseif ($this->authTimeout !== null) {
                        $session->set($this->authTimeoutParam, time() + $this->authTimeout);
                    }
                }

                return $logoutPromise->then(function() {
                    if ($this->enableAutoLogin) {
                        if ($this->getIsGuest()) {
                            return $this->loginByCookie();
                        } elseif ($this->autoRenewCookie) {
                            $this->renewIdentityCookie();
                        }
                    }
                    return true;
                });
            });
    }
Updates the authentication status using the information from session and cookie.

This method will try to determine the user identity using the [[idParam]] session variable.

If [[authTimeout]] is set, this method will refresh the timer.

If the user identity cannot be determined by session, this method will try to [[loginByCookie()|login by cookie]]
if [[enableAutoLogin]] is true.
@return ExtendedPromiseInterface