java.lang.Object | ||
↳ | org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices | |
↳ | org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices |
Identifies previously remembered users by a Base-64 encoded cookie.
This implementation does not rely on an external database, so is attractive
for simple applications. The cookie will be valid for a specific period from
the date of the last loginSuccess(HttpServletRequest, HttpServletResponse, Authentication)
.
As per the interface contract, this method will only be called when the
principal completes a successful interactive authentication. As such the time
period commences from the last authentication attempt where they furnished
credentials - not the time period they last logged in via remember-me. The
implementation will only send a remember-me token if the parameter defined by
setParameter(String)
is present.
An UserDetailsService
is required by
this implementation, so that it can construct a valid
Authentication
from the returned UserDetails
.
This is also necessary so that the user's password is available and can be checked as part of the encoded cookie.
The cookie encoded by this implementation adopts the following form:
username + ":" + expiryTime + ":" + Md5Hex(username + ":" + expiryTime + ":" + password + ":" + key)
As such, if the user changes their password, any remember-me token will be invalidated. Equally, the system administrator may invalidate every remember-me token on issue by changing the key. This provides some reasonable approaches to recovering from a remember-me token being left on a public machine (e.g. kiosk system, Internet cafe etc). Most importantly, at no time is the user's password ever sent to the user agent, providing an important security safeguard. Unfortunately the username is necessary in this implementation (as we do not want to rely on a database for remember-me services). High security applications should be aware of this occasionally undesired disclosure of a valid username.
This is a basic remember-me implementation which is suitable for many
applications. However, we recommend a database-based implementation if you
require a more secure remember-me approach (see PersistentTokenBasedRememberMeServices
).
By default the tokens will be valid for 14 days from the last successful authentication attempt. This can be changed
using setTokenValiditySeconds(int)
. If this value is less than zero, the expiryTime will remain at
14 days, but the negative value will be used for the maxAge property of the cookie, meaning that it will
not be stored when the browser is closed.
[Expand]
Inherited Constants | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
From class
org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices
|
[Expand]
Inherited Fields | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
From class
org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices
|
Public Constructors | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
This constructor is deprecated.
Use with-args constructor
| |||||||||||
Public Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Called from loginSuccess when a remember-me login has been requested.
|
Protected Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
Calculates the validity period in seconds for a newly generated remember-me login.
| |||||||||||
Calculates the digital signature to be put in the cookie.
| |||||||||||
Called from autoLogin to process the submitted persistent login cookie.
| |||||||||||
[Expand]
Inherited Methods | |||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|
From class
org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices
| |||||||||||
From class
java.lang.Object
| |||||||||||
From interface
org.springframework.beans.factory.InitializingBean
| |||||||||||
From interface
org.springframework.security.web.authentication.RememberMeServices
| |||||||||||
From interface
org.springframework.security.web.authentication.logout.LogoutHandler
|
This constructor is deprecated.
Use with-args constructor
Called from loginSuccess when a remember-me login has been requested. Typically implemented by subclasses to set a remember-me cookie and potentially store a record of it if the implementation requires this.
Calculates the validity period in seconds for a newly generated remember-me login. After this period (from the current time) the remember-me login will be considered expired. This method allows customization based on request parameters supplied with the login or information in the Authentication object. The default value is just the token validity period property, tokenValiditySeconds.
The returned value will be used to work out the expiry time of the token and will also be used to set the maxAge property of the cookie. See SEC-485.
request | the request passed to onLoginSuccess |
---|---|
authentication | the successful authentication object. |
Calculates the digital signature to be put in the cookie. Default value is MD5 ("username:tokenExpiryTime:password:key")
Called from autoLogin to process the submitted persistent login cookie. Subclasses should validate the cookie and perform any additional management required.
cookieTokens | the decoded and tokenized cookie value |
---|---|
request | the request |
response | the response, to allow the cookie to be modified if required. |