org.springframework.security.web.authentication.rememberme

Class AbstractRememberMeServices

java.lang.Object

org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices

All Implemented Interfaces:

org.springframework.beans.factory.InitializingBean, LogoutHandler, RememberMeServices

Direct Known Subclasses:

PersistentTokenBasedRememberMeServices, TokenBasedRememberMeServices

public abstract class AbstractRememberMeServices
extends java.lang.Object
implements RememberMeServices, org.springframework.beans.factory.InitializingBean, LogoutHandler

Base class for RememberMeServices implementations.

Since:

2.0

Field Summary

Fields

Modifier and Type	Field and Description
static java.lang.String	DEFAULT_PARAMETER
protected org.apache.commons.logging.Log	logger
protected org.springframework.context.support.MessageSourceAccessor	messages
static java.lang.String	SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY
static int	TWO_WEEKS_S

Constructor Summary

Constructors

Modifier	Constructor and Description
protected	AbstractRememberMeServices(java.lang.String key, UserDetailsService userDetailsService)

Method Summary

Modifier and Type	Method and Description
void	afterPropertiesSet()
Authentication	autoLogin(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Template implementation which locates the Spring Security cookie, decodes it into a delimited array of tokens and submits it to subclasses for processing via the processAutoLoginCookie method.
protected void	cancelCookie(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Sets a "cancel cookie" (with maxAge = 0) on the response to disable persistent logins.
protected Authentication	createSuccessfulAuthentication(javax.servlet.http.HttpServletRequest request, UserDetails user) Creates the final Authentication object returned from the autoLogin method.
protected java.lang.String[]	decodeCookie(java.lang.String cookieValue) Decodes the cookie and splits it into a set of token strings using the ":" delimiter.
protected java.lang.String	encodeCookie(java.lang.String[] cookieTokens) Inverse operation of decodeCookie.
protected java.lang.String	extractRememberMeCookie(javax.servlet.http.HttpServletRequest request) Locates the Spring Security remember me cookie in the request and returns its value.
protected AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,?>	getAuthenticationDetailsSource()
protected java.lang.String	getCookieName()
java.lang.String	getKey()
java.lang.String	getParameter()
protected int	getTokenValiditySeconds()
protected UserDetailsService	getUserDetailsService()
void	loginFail(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid.
void	loginSuccess(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Authentication successfulAuthentication) Called whenever an interactive authentication attempt is successful.
void	logout(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Authentication authentication) Implementation of LogoutHandler.
protected void	onLoginFail(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
protected abstract void	onLoginSuccess(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Authentication successfulAuthentication) Called from loginSuccess when a remember-me login has been requested.
protected abstract UserDetails	processAutoLoginCookie(java.lang.String[] cookieTokens, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Called from autoLogin to process the submitted persistent login cookie.
protected boolean	rememberMeRequested(javax.servlet.http.HttpServletRequest request, java.lang.String parameter) Allows customization of whether a remember-me login has been requested.
void	setAlwaysRemember(boolean alwaysRemember)
void	setAuthenticationDetailsSource(AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,?> authenticationDetailsSource)
void	setAuthoritiesMapper(GrantedAuthoritiesMapper authoritiesMapper)
protected void	setCookie(java.lang.String[] tokens, int maxAge, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response) Sets the cookie on the response.
void	setCookieDomain(java.lang.String cookieDomain)
void	setCookieName(java.lang.String cookieName)
void	setParameter(java.lang.String parameter) Sets the name of the parameter which should be checked for to see if a remember-me has been requested during a login request.
void	setTokenValiditySeconds(int tokenValiditySeconds)
void	setUserDetailsChecker(UserDetailsChecker userDetailsChecker) Sets the strategy to be used to validate the UserDetails object obtained for the user when processing a remember-me cookie to automatically log in a user.
void	setUseSecureCookie(boolean useSecureCookie) Whether the cookie should be flagged as secure or not.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY

public static final java.lang.String SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY

See Also:

Constant Field Values

DEFAULT_PARAMETER

public static final java.lang.String DEFAULT_PARAMETER

See Also:

Constant Field Values

TWO_WEEKS_S

public static final int TWO_WEEKS_S

See Also:

Constant Field Values

logger

protected final org.apache.commons.logging.Log logger

messages

protected final org.springframework.context.support.MessageSourceAccessor messages

Constructor Detail

AbstractRememberMeServices

protected AbstractRememberMeServices(java.lang.String key,
                                     UserDetailsService userDetailsService)

Method Detail

afterPropertiesSet

public void afterPropertiesSet()
                        throws java.lang.Exception

Specified by:

afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

Throws:

java.lang.Exception

autoLogin

public final Authentication autoLogin(javax.servlet.http.HttpServletRequest request,
                                      javax.servlet.http.HttpServletResponse response)

Template implementation which locates the Spring Security cookie, decodes it into a delimited array of tokens and submits it to subclasses for processing via the processAutoLoginCookie method.

The returned username is then used to load the UserDetails object for the user, which in turn is used to create a valid authentication token.

Specified by:

autoLogin in interface RememberMeServices

Parameters:

request - to look for a remember-me token within

response - to change, cancel or modify the remember-me token

Returns:

a valid authentication object, or null if the request should not be authenticated

extractRememberMeCookie

protected java.lang.String extractRememberMeCookie(javax.servlet.http.HttpServletRequest request)

Locates the Spring Security remember me cookie in the request and returns its value. The cookie is searched for by name and also by matching the context path to the cookie path.

Parameters:

request - the submitted request which is to be authenticated

Returns:

the cookie value (if present), null otherwise.

createSuccessfulAuthentication

protected Authentication createSuccessfulAuthentication(javax.servlet.http.HttpServletRequest request,
                                                        UserDetails user)

Creates the final Authentication object returned from the autoLogin method.

By default it will create a RememberMeAuthenticationToken instance.

Parameters:

request - the original request. The configured AuthenticationDetailsSource will use this to build the details property of the returned object.

user - the UserDetails loaded from the UserDetailsService. This will be stored as the principal.

Returns:

the Authentication for the remember-me authenticated user

decodeCookie

protected java.lang.String[] decodeCookie(java.lang.String cookieValue)
                                   throws InvalidCookieException

Decodes the cookie and splits it into a set of token strings using the ":" delimiter.

Parameters:

cookieValue - the value obtained from the submitted cookie

Returns:

the array of tokens.

Throws:

InvalidCookieException - if the cookie was not base64 encoded.

encodeCookie

protected java.lang.String encodeCookie(java.lang.String[] cookieTokens)

Inverse operation of decodeCookie.

Parameters:

cookieTokens - the tokens to be encoded.

Returns:

base64 encoding of the tokens concatenated with the ":" delimiter.

loginFail

public final void loginFail(javax.servlet.http.HttpServletRequest request,
                            javax.servlet.http.HttpServletResponse response)

Description copied from interface: RememberMeServices

Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid. Implementations should invalidate any and all remember-me tokens indicated in the HttpServletRequest.

Specified by:

loginFail in interface RememberMeServices

Parameters:

request - that contained an invalid authentication request

response - to change, cancel or modify the remember-me token

onLoginFail

protected void onLoginFail(javax.servlet.http.HttpServletRequest request,
                           javax.servlet.http.HttpServletResponse response)

loginSuccess

public final void loginSuccess(javax.servlet.http.HttpServletRequest request,
                               javax.servlet.http.HttpServletResponse response,
                               Authentication successfulAuthentication)

Called whenever an interactive authentication attempt is successful. An implementation may automatically set a remember-me token in the HttpServletResponse, although this is not recommended. Instead, implementations should typically look for a request parameter that indicates the browser has presented an explicit request for authentication to be remembered, such as the presence of a HTTP POST parameter.

Examines the incoming request and checks for the presence of the configured "remember me" parameter. If it's present, or if alwaysRemember is set to true, calls onLoginSucces.

Specified by:

loginSuccess in interface RememberMeServices

Parameters:

request - that contained the valid authentication request

response - to change, cancel or modify the remember-me token

successfulAuthentication - representing the successfully authenticated principal

onLoginSuccess

protected abstract void onLoginSuccess(javax.servlet.http.HttpServletRequest request,
                                       javax.servlet.http.HttpServletResponse response,
                                       Authentication successfulAuthentication)

Called from loginSuccess when a remember-me login has been requested. Typically implemented by subclasses to set a remember-me cookie and potentially store a record of it if the implementation requires this.

rememberMeRequested

protected boolean rememberMeRequested(javax.servlet.http.HttpServletRequest request,
                                      java.lang.String parameter)

Allows customization of whether a remember-me login has been requested. The default is to return true if alwaysRemember is set or the configured parameter name has been included in the request and is set to the value "true".

Parameters:

request - the request submitted from an interactive login, which may include additional information indicating that a persistent login is desired.

parameter - the configured remember-me parameter name.

Returns:

true if the request includes information indicating that a persistent login has been requested.

processAutoLoginCookie

protected abstract UserDetails processAutoLoginCookie(java.lang.String[] cookieTokens,
                                                      javax.servlet.http.HttpServletRequest request,
                                                      javax.servlet.http.HttpServletResponse response)
                                               throws RememberMeAuthenticationException,
                                                      UsernameNotFoundException

Called from autoLogin to process the submitted persistent login cookie. Subclasses should validate the cookie and perform any additional management required.

Parameters:

cookieTokens - the decoded and tokenized cookie value

request - the request

response - the response, to allow the cookie to be modified if required.

Returns:

the UserDetails for the corresponding user account if the cookie was validated successfully.

Throws:

RememberMeAuthenticationException - if the cookie is invalid or the login is invalid for some other reason.

UsernameNotFoundException - if the user account corresponding to the login cookie couldn't be found (for example if the user has been removed from the system).

cancelCookie

protected void cancelCookie(javax.servlet.http.HttpServletRequest request,
                            javax.servlet.http.HttpServletResponse response)

Sets a "cancel cookie" (with maxAge = 0) on the response to disable persistent logins.

setCookie

protected void setCookie(java.lang.String[] tokens,
                         int maxAge,
                         javax.servlet.http.HttpServletRequest request,
                         javax.servlet.http.HttpServletResponse response)

Sets the cookie on the response. By default a secure cookie will be used if the connection is secure. You can set the useSecureCookie property to false to override this. If you set it to true, the cookie will always be flagged as secure. If Servlet 3.0 is used, the cookie will be marked as HttpOnly.

Parameters:

tokens - the tokens which will be encoded to make the cookie value.

maxAge - the value passed to Cookie.setMaxAge(int)

request - the request

response - the response to add the cookie to.

logout

public void logout(javax.servlet.http.HttpServletRequest request,
                   javax.servlet.http.HttpServletResponse response,
                   Authentication authentication)

Implementation of LogoutHandler. Default behaviour is to call cancelCookie().

Specified by:

logout in interface LogoutHandler

Parameters:

request - the HTTP request

response - the HTTP response

authentication - the current principal details

setCookieName

public void setCookieName(java.lang.String cookieName)

setCookieDomain

public void setCookieDomain(java.lang.String cookieDomain)

getCookieName

protected java.lang.String getCookieName()

setAlwaysRemember

public void setAlwaysRemember(boolean alwaysRemember)

setParameter

public void setParameter(java.lang.String parameter)

Sets the name of the parameter which should be checked for to see if a remember-me has been requested during a login request. This should be the same name you assign to the checkbox in your login form.

Parameters:

parameter - the HTTP request parameter

getParameter

public java.lang.String getParameter()

getUserDetailsService

protected UserDetailsService getUserDetailsService()

getKey

public java.lang.String getKey()

setTokenValiditySeconds

public void setTokenValiditySeconds(int tokenValiditySeconds)

getTokenValiditySeconds

protected int getTokenValiditySeconds()

setUseSecureCookie

public void setUseSecureCookie(boolean useSecureCookie)

Whether the cookie should be flagged as secure or not. Secure cookies can only be sent over an HTTPS connection and thus cannot be accidentally submitted over HTTP where they could be intercepted.

By default the cookie will be secure if the request is secure. If you only want to use remember-me over HTTPS (recommended) you should set this property to true.

Parameters:

useSecureCookie - set to true to always user secure cookies, false to disable their use.

getAuthenticationDetailsSource

protected AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,?> getAuthenticationDetailsSource()

setAuthenticationDetailsSource

public void setAuthenticationDetailsSource(AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,?> authenticationDetailsSource)

setUserDetailsChecker

public void setUserDetailsChecker(UserDetailsChecker userDetailsChecker)

Sets the strategy to be used to validate the UserDetails object obtained for the user when processing a remember-me cookie to automatically log in a user.

Parameters:

userDetailsChecker - the strategy which will be passed the user object to allow it to be rejected if account should not be allowed to authenticate (if it is locked, for example). Defaults to a AccountStatusUserDetailsChecker instance.

setAuthoritiesMapper

public void setAuthoritiesMapper(GrantedAuthoritiesMapper authoritiesMapper)