public abstract class

AbstractRememberMeServices

extends Object
implements InitializingBean RememberMeServices LogoutHandler
java.lang.Object
   ↳ org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices
Known Direct Subclasses

Class Overview

Base class for RememberMeServices implementations.

Summary

Constants
String DEFAULT_PARAMETER
String SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY
int TWO_WEEKS_S
Fields
protected final Log logger
protected final MessageSourceAccessor messages
Protected Constructors
AbstractRememberMeServices()
This constructor is deprecated. Use constructor injection
AbstractRememberMeServices(String key, UserDetailsService userDetailsService)
Public Methods
void afterPropertiesSet()
final Authentication autoLogin(HttpServletRequest request, HttpServletResponse response)
Template implementation which locates the Spring Security cookie, decodes it into a delimited array of tokens and submits it to subclasses for processing via the processAutoLoginCookie method.
String getKey()
String getParameter()
final void loginFail(HttpServletRequest request, HttpServletResponse response)
Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid.
final void loginSuccess(HttpServletRequest request, HttpServletResponse response, Authentication successfulAuthentication)
Examines the incoming request and checks for the presence of the configured "remember me" parameter.
void logout(HttpServletRequest request, HttpServletResponse response, Authentication authentication)
Implementation of LogoutHandler.
void setAlwaysRemember(boolean alwaysRemember)
void setAuthenticationDetailsSource(AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource)
void setAuthoritiesMapper(GrantedAuthoritiesMapper authoritiesMapper)
void setCookieName(String cookieName)
void setKey(String key)
This method is deprecated. Use constructor injection
void setParameter(String parameter)
Sets the name of the parameter which should be checked for to see if a remember-me has been requested during a login request.
void setTokenValiditySeconds(int tokenValiditySeconds)
void setUseSecureCookie(boolean useSecureCookie)
Whether the cookie should be flagged as secure or not.
void setUserDetailsChecker(UserDetailsChecker userDetailsChecker)
Sets the strategy to be used to validate the UserDetails object obtained for the user when processing a remember-me cookie to automatically log in a user.
void setUserDetailsService(UserDetailsService userDetailsService)
This method is deprecated. Use constructor injection
Protected Methods
void cancelCookie(HttpServletRequest request, HttpServletResponse response)
Sets a "cancel cookie" (with maxAge = 0) on the response to disable persistent logins.
Authentication createSuccessfulAuthentication(HttpServletRequest request, UserDetails user)
Creates the final Authentication object returned from the autoLogin method.
String[] decodeCookie(String cookieValue)
Decodes the cookie and splits it into a set of token strings using the ":" delimiter.
String encodeCookie(String[] cookieTokens)
Inverse operation of decodeCookie.
String extractRememberMeCookie(HttpServletRequest request)
Locates the Spring Security remember me cookie in the request and returns its value.
AuthenticationDetailsSource<HttpServletRequest, ?> getAuthenticationDetailsSource()
String getCookieName()
int getTokenValiditySeconds()
UserDetailsService getUserDetailsService()
void onLoginFail(HttpServletRequest request, HttpServletResponse response)
abstract void onLoginSuccess(HttpServletRequest request, HttpServletResponse response, Authentication successfulAuthentication)
Called from loginSuccess when a remember-me login has been requested.
abstract UserDetails processAutoLoginCookie(String[] cookieTokens, HttpServletRequest request, HttpServletResponse response)
Called from autoLogin to process the submitted persistent login cookie.
boolean rememberMeRequested(HttpServletRequest request, String parameter)
Allows customization of whether a remember-me login has been requested.
void setCookie(String[] tokens, int maxAge, HttpServletRequest request, HttpServletResponse response)
Sets the cookie on the response.
[Expand]
Inherited Methods
From class java.lang.Object
From interface org.springframework.beans.factory.InitializingBean
From interface org.springframework.security.web.authentication.RememberMeServices
From interface org.springframework.security.web.authentication.logout.LogoutHandler

Constants

public static final String DEFAULT_PARAMETER

Constant Value: "_spring_security_remember_me"

public static final String SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY

Constant Value: "SPRING_SECURITY_REMEMBER_ME_COOKIE"

public static final int TWO_WEEKS_S

Constant Value: 1209600 (0x00127500)

Fields

protected final Log logger

protected final MessageSourceAccessor messages

Protected Constructors

protected AbstractRememberMeServices ()

This constructor is deprecated.
Use constructor injection

protected AbstractRememberMeServices (String key, UserDetailsService userDetailsService)

Public Methods

public void afterPropertiesSet ()

Throws
Exception

public final Authentication autoLogin (HttpServletRequest request, HttpServletResponse response)

Template implementation which locates the Spring Security cookie, decodes it into a delimited array of tokens and submits it to subclasses for processing via the processAutoLoginCookie method.

The returned username is then used to load the UserDetails object for the user, which in turn is used to create a valid authentication token.

Parameters
request to look for a remember-me token within
response to change, cancel or modify the remember-me token
Returns
  • a valid authentication object, or null if the request should not be authenticated

public String getKey ()

public String getParameter ()

public final void loginFail (HttpServletRequest request, HttpServletResponse response)

Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid. Implementations should invalidate any and all remember-me tokens indicated in the HttpServletRequest.

Parameters
request that contained an invalid authentication request
response to change, cancel or modify the remember-me token

public final void loginSuccess (HttpServletRequest request, HttpServletResponse response, Authentication successfulAuthentication)

Examines the incoming request and checks for the presence of the configured "remember me" parameter. If it's present, or if alwaysRemember is set to true, calls onLoginSucces.

Parameters
request that contained the valid authentication request
response to change, cancel or modify the remember-me token
successfulAuthentication representing the successfully authenticated principal

public void logout (HttpServletRequest request, HttpServletResponse response, Authentication authentication)

Implementation of LogoutHandler. Default behaviour is to call cancelCookie().

Parameters
request the HTTP request
response the HTTP response
authentication the current principal details

public void setAlwaysRemember (boolean alwaysRemember)

public void setAuthenticationDetailsSource (AuthenticationDetailsSource<HttpServletRequest, ?> authenticationDetailsSource)

public void setAuthoritiesMapper (GrantedAuthoritiesMapper authoritiesMapper)

public void setCookieName (String cookieName)

public void setKey (String key)

This method is deprecated.
Use constructor injection

public void setParameter (String parameter)

Sets the name of the parameter which should be checked for to see if a remember-me has been requested during a login request. This should be the same name you assign to the checkbox in your login form.

Parameters
parameter the HTTP request parameter

public void setTokenValiditySeconds (int tokenValiditySeconds)

public void setUseSecureCookie (boolean useSecureCookie)

Whether the cookie should be flagged as secure or not. Secure cookies can only be sent over an HTTPS connection and this cannot be accidentally submitted over HTTP where they could be intercepted.

By default the cookie will be secure if the request is secure. If you only want to use remember-me over HTTPS (recommended) you should set this property to true.

Parameters
useSecureCookie set to true to always user secure cookies, false to disable their use.

public void setUserDetailsChecker (UserDetailsChecker userDetailsChecker)

Sets the strategy to be used to validate the UserDetails object obtained for the user when processing a remember-me cookie to automatically log in a user.

Parameters
userDetailsChecker the strategy which will be passed the user object to allow it to be rejected if account should not be allowed to authenticate (if it is locked, for example). Defaults to a AccountStatusUserDetailsChecker instance.

public void setUserDetailsService (UserDetailsService userDetailsService)

This method is deprecated.
Use constructor injection

Protected Methods

protected void cancelCookie (HttpServletRequest request, HttpServletResponse response)

Sets a "cancel cookie" (with maxAge = 0) on the response to disable persistent logins.

protected Authentication createSuccessfulAuthentication (HttpServletRequest request, UserDetails user)

Creates the final Authentication object returned from the autoLogin method.

By default it will create a RememberMeAuthenticationToken instance.

Parameters
request the original request. The configured AuthenticationDetailsSource will use this to build the details property of the returned object.
user the UserDetails loaded from the UserDetailsService. This will be stored as the principal.
Returns
  • the Authentication for the remember-me authenticated user

protected String[] decodeCookie (String cookieValue)

Decodes the cookie and splits it into a set of token strings using the ":" delimiter.

Parameters
cookieValue the value obtained from the submitted cookie
Returns
  • the array of tokens.
Throws
InvalidCookieException if the cookie was not base64 encoded.

protected String encodeCookie (String[] cookieTokens)

Inverse operation of decodeCookie.

Parameters
cookieTokens the tokens to be encoded.
Returns
  • base64 encoding of the tokens concatenated with the ":" delimiter.

protected String extractRememberMeCookie (HttpServletRequest request)

Locates the Spring Security remember me cookie in the request and returns its value. The cookie is searched for by name and also by matching the context path to the cookie path.

Parameters
request the submitted request which is to be authenticated
Returns
  • the cookie value (if present), null otherwise.

protected AuthenticationDetailsSource<HttpServletRequest, ?> getAuthenticationDetailsSource ()

protected String getCookieName ()

protected int getTokenValiditySeconds ()

protected UserDetailsService getUserDetailsService ()

protected void onLoginFail (HttpServletRequest request, HttpServletResponse response)

protected abstract void onLoginSuccess (HttpServletRequest request, HttpServletResponse response, Authentication successfulAuthentication)

Called from loginSuccess when a remember-me login has been requested. Typically implemented by subclasses to set a remember-me cookie and potentially store a record of it if the implementation requires this.

protected abstract UserDetails processAutoLoginCookie (String[] cookieTokens, HttpServletRequest request, HttpServletResponse response)

Called from autoLogin to process the submitted persistent login cookie. Subclasses should validate the cookie and perform any additional management required.

Parameters
cookieTokens the decoded and tokenized cookie value
request the request
response the response, to allow the cookie to be modified if required.
Returns
  • the UserDetails for the corresponding user account if the cookie was validated successfully.
Throws
RememberMeAuthenticationException if the cookie is invalid or the login is invalid for some other reason.
UsernameNotFoundException if the user account corresponding to the login cookie couldn't be found (for example if the user has been removed from the system).

protected boolean rememberMeRequested (HttpServletRequest request, String parameter)

Allows customization of whether a remember-me login has been requested. The default is to return true if alwaysRemember is set or the configured parameter name has been included in the request and is set to the value "true".

Parameters
request the request submitted from an interactive login, which may include additional information indicating that a persistent login is desired.
parameter the configured remember-me parameter name.
Returns
  • true if the request includes information indicating that a persistent login has been requested.

protected void setCookie (String[] tokens, int maxAge, HttpServletRequest request, HttpServletResponse response)

Sets the cookie on the response. By default a secure cookie will be used if the connection is secure. You can set the useSecureCookie property to false to override this. If you set it to true, the cookie will always be flagged as secure. If Servlet 3.0 is used, the cookie will be marked as HttpOnly.

Parameters
tokens the tokens which will be encoded to make the cookie value.
maxAge the value passed to setMaxAge(int)
request the request
response the response to add the cookie to.