Package org.springframework.security.web.authentication.rememberme

Class AbstractRememberMeServices

    • Method Summary

      All Methods Instance Methods Abstract Methods Concrete Methods 
      Modifier and Type Method Description
      void afterPropertiesSet()  
      Authentication autoLogin​(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
      Template implementation which locates the Spring Security cookie, decodes it into a delimited array of tokens and submits it to subclasses for processing via the processAutoLoginCookie method.
      protected void cancelCookie​(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
      Sets a "cancel cookie" (with maxAge = 0) on the response to disable persistent logins.
      protected Authentication createSuccessfulAuthentication​(javax.servlet.http.HttpServletRequest request, UserDetails user)
      Creates the final Authentication object returned from the autoLogin method.
      protected java.lang.String[] decodeCookie​(java.lang.String cookieValue)
      Decodes the cookie and splits it into a set of token strings using the ":" delimiter.
      protected java.lang.String encodeCookie​(java.lang.String[] cookieTokens)
      Inverse operation of decodeCookie.
      protected java.lang.String extractRememberMeCookie​(javax.servlet.http.HttpServletRequest request)
      Locates the Spring Security remember me cookie in the request and returns its value.
      protected AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,​?> getAuthenticationDetailsSource()  
      protected java.lang.String getCookieName()  
      java.lang.String getKey()  
      java.lang.String getParameter()  
      protected int getTokenValiditySeconds()  
      protected UserDetailsService getUserDetailsService()  
      void loginFail​(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
      Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid.
      void loginSuccess​(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Authentication successfulAuthentication)
      Called whenever an interactive authentication attempt is successful.
      void logout​(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Authentication authentication)
      Implementation of LogoutHandler.
      protected void onLoginFail​(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)  
      protected abstract void onLoginSuccess​(javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response, Authentication successfulAuthentication)
      Called from loginSuccess when a remember-me login has been requested.
      protected abstract UserDetails processAutoLoginCookie​(java.lang.String[] cookieTokens, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
      Called from autoLogin to process the submitted persistent login cookie.
      protected boolean rememberMeRequested​(javax.servlet.http.HttpServletRequest request, java.lang.String parameter)
      Allows customization of whether a remember-me login has been requested.
      void setAlwaysRemember​(boolean alwaysRemember)  
      void setAuthenticationDetailsSource​(AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,​?> authenticationDetailsSource)  
      void setAuthoritiesMapper​(GrantedAuthoritiesMapper authoritiesMapper)  
      protected void setCookie​(java.lang.String[] tokens, int maxAge, javax.servlet.http.HttpServletRequest request, javax.servlet.http.HttpServletResponse response)
      Sets the cookie on the response.
      void setCookieDomain​(java.lang.String cookieDomain)  
      void setCookieName​(java.lang.String cookieName)  
      void setMessageSource​(org.springframework.context.MessageSource messageSource)  
      void setParameter​(java.lang.String parameter)
      Sets the name of the parameter which should be checked for to see if a remember-me has been requested during a login request.
      void setTokenValiditySeconds​(int tokenValiditySeconds)  
      void setUserDetailsChecker​(UserDetailsChecker userDetailsChecker)
      Sets the strategy to be used to validate the UserDetails object obtained for the user when processing a remember-me cookie to automatically log in a user.
      void setUseSecureCookie​(boolean useSecureCookie)
      Whether the cookie should be flagged as secure or not.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Field Detail

      • SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY

        public static final java.lang.String SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY
        See Also:
        Constant Field Values

      • DEFAULT_PARAMETER

        public static final java.lang.String DEFAULT_PARAMETER
        See Also:
        Constant Field Values

      • logger

        protected final org.apache.commons.logging.Log logger

      • messages

        protected org.springframework.context.support.MessageSourceAccessor messages

    • Constructor Detail

      • AbstractRememberMeServices

        protected AbstractRememberMeServices​(java.lang.String key,
                                     UserDetailsService userDetailsService)

    • Method Detail

      • afterPropertiesSet

        public void afterPropertiesSet()
        Specified by:
        afterPropertiesSet in interface org.springframework.beans.factory.InitializingBean

      • autoLogin

        public final Authentication autoLogin​(javax.servlet.http.HttpServletRequest request,
                                      javax.servlet.http.HttpServletResponse response)
        Template implementation which locates the Spring Security cookie, decodes it into a delimited array of tokens and submits it to subclasses for processing via the processAutoLoginCookie method.

        The returned username is then used to load the UserDetails object for the user, which in turn is used to create a valid authentication token.

        Specified by:
        autoLogin in interface RememberMeServices
        Parameters:
        request - to look for a remember-me token within
        response - to change, cancel or modify the remember-me token
        Returns:
        a valid authentication object, or null if the request should not be authenticated

      • extractRememberMeCookie

        protected java.lang.String extractRememberMeCookie​(javax.servlet.http.HttpServletRequest request)
        Locates the Spring Security remember me cookie in the request and returns its value. The cookie is searched for by name and also by matching the context path to the cookie path.
        Parameters:
        request - the submitted request which is to be authenticated
        Returns:
        the cookie value (if present), null otherwise.

      • createSuccessfulAuthentication

        protected Authentication createSuccessfulAuthentication​(javax.servlet.http.HttpServletRequest request,
                                                        UserDetails user)
        Creates the final Authentication object returned from the autoLogin method.

        By default it will create a RememberMeAuthenticationToken instance.

        Parameters:
        request - the original request. The configured AuthenticationDetailsSource will use this to build the details property of the returned object.
        user - the UserDetails loaded from the UserDetailsService. This will be stored as the principal.
        Returns:
        the Authentication for the remember-me authenticated user

      • decodeCookie

        protected java.lang.String[] decodeCookie​(java.lang.String cookieValue)
                                   throws InvalidCookieException
        Decodes the cookie and splits it into a set of token strings using the ":" delimiter.
        Parameters:
        cookieValue - the value obtained from the submitted cookie
        Returns:
        the array of tokens.
        Throws:
        InvalidCookieException - if the cookie was not base64 encoded.

      • encodeCookie

        protected java.lang.String encodeCookie​(java.lang.String[] cookieTokens)
        Inverse operation of decodeCookie.
        Parameters:
        cookieTokens - the tokens to be encoded.
        Returns:
        base64 encoding of the tokens concatenated with the ":" delimiter.

      • loginFail

        public final void loginFail​(javax.servlet.http.HttpServletRequest request,
                            javax.servlet.http.HttpServletResponse response)
        Description copied from interface: RememberMeServices
        Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid. Implementations should invalidate any and all remember-me tokens indicated in the HttpServletRequest.
        Specified by:
        loginFail in interface RememberMeServices
        Parameters:
        request - that contained an invalid authentication request
        response - to change, cancel or modify the remember-me token

      • onLoginFail

        protected void onLoginFail​(javax.servlet.http.HttpServletRequest request,
                           javax.servlet.http.HttpServletResponse response)

      • loginSuccess

        public final void loginSuccess​(javax.servlet.http.HttpServletRequest request,
                               javax.servlet.http.HttpServletResponse response,
                               Authentication successfulAuthentication)
        Called whenever an interactive authentication attempt is successful. An implementation may automatically set a remember-me token in the HttpServletResponse, although this is not recommended. Instead, implementations should typically look for a request parameter that indicates the browser has presented an explicit request for authentication to be remembered, such as the presence of a HTTP POST parameter.

        Examines the incoming request and checks for the presence of the configured "remember me" parameter. If it's present, or if alwaysRemember is set to true, calls onLoginSucces.

        Specified by:
        loginSuccess in interface RememberMeServices
        Parameters:
        request - that contained the valid authentication request
        response - to change, cancel or modify the remember-me token
        successfulAuthentication - representing the successfully authenticated principal

      • onLoginSuccess

        protected abstract void onLoginSuccess​(javax.servlet.http.HttpServletRequest request,
                                       javax.servlet.http.HttpServletResponse response,
                                       Authentication successfulAuthentication)
        Called from loginSuccess when a remember-me login has been requested. Typically implemented by subclasses to set a remember-me cookie and potentially store a record of it if the implementation requires this.

      • rememberMeRequested

        protected boolean rememberMeRequested​(javax.servlet.http.HttpServletRequest request,
                                      java.lang.String parameter)
        Allows customization of whether a remember-me login has been requested. The default is to return true if alwaysRemember is set or the configured parameter name has been included in the request and is set to the value "true".
        Parameters:
        request - the request submitted from an interactive login, which may include additional information indicating that a persistent login is desired.
        parameter - the configured remember-me parameter name.
        Returns:
        true if the request includes information indicating that a persistent login has been requested.

      • processAutoLoginCookie

        protected abstract UserDetails processAutoLoginCookie​(java.lang.String[] cookieTokens,
                                                      javax.servlet.http.HttpServletRequest request,
                                                      javax.servlet.http.HttpServletResponse response)
                                               throws RememberMeAuthenticationException,
                                                      UsernameNotFoundException
        Called from autoLogin to process the submitted persistent login cookie. Subclasses should validate the cookie and perform any additional management required.
        Parameters:
        cookieTokens - the decoded and tokenized cookie value
        request - the request
        response - the response, to allow the cookie to be modified if required.
        Returns:
        the UserDetails for the corresponding user account if the cookie was validated successfully.
        Throws:
        RememberMeAuthenticationException - if the cookie is invalid or the login is invalid for some other reason.
        UsernameNotFoundException - if the user account corresponding to the login cookie couldn't be found (for example if the user has been removed from the system).

      • cancelCookie

        protected void cancelCookie​(javax.servlet.http.HttpServletRequest request,
                            javax.servlet.http.HttpServletResponse response)
        Sets a "cancel cookie" (with maxAge = 0) on the response to disable persistent logins.

      • setCookie

        protected void setCookie​(java.lang.String[] tokens,
                         int maxAge,
                         javax.servlet.http.HttpServletRequest request,
                         javax.servlet.http.HttpServletResponse response)
        Sets the cookie on the response. By default a secure cookie will be used if the connection is secure. You can set the useSecureCookie property to false to override this. If you set it to true, the cookie will always be flagged as secure. By default the cookie will be marked as HttpOnly.
        Parameters:
        tokens - the tokens which will be encoded to make the cookie value.
        maxAge - the value passed to Cookie.setMaxAge(int)
        request - the request
        response - the response to add the cookie to.

      • logout

        public void logout​(javax.servlet.http.HttpServletRequest request,
                   javax.servlet.http.HttpServletResponse response,
                   Authentication authentication)
        Implementation of LogoutHandler. Default behaviour is to call cancelCookie().
        Specified by:
        logout in interface LogoutHandler
        Parameters:
        request - the HTTP request
        response - the HTTP response
        authentication - the current principal details

      • setCookieName

        public void setCookieName​(java.lang.String cookieName)

      • setCookieDomain

        public void setCookieDomain​(java.lang.String cookieDomain)

      • getCookieName

        protected java.lang.String getCookieName()

      • setAlwaysRemember

        public void setAlwaysRemember​(boolean alwaysRemember)

      • setParameter

        public void setParameter​(java.lang.String parameter)
        Sets the name of the parameter which should be checked for to see if a remember-me has been requested during a login request. This should be the same name you assign to the checkbox in your login form.
        Parameters:
        parameter - the HTTP request parameter

      • getParameter

        public java.lang.String getParameter()

      • getKey

        public java.lang.String getKey()

      • setTokenValiditySeconds

        public void setTokenValiditySeconds​(int tokenValiditySeconds)

      • getTokenValiditySeconds

        protected int getTokenValiditySeconds()

      • setUseSecureCookie

        public void setUseSecureCookie​(boolean useSecureCookie)
        Whether the cookie should be flagged as secure or not. Secure cookies can only be sent over an HTTPS connection and thus cannot be accidentally submitted over HTTP where they could be intercepted.

        By default the cookie will be secure if the request is secure. If you only want to use remember-me over HTTPS (recommended) you should set this property to true.

        Parameters:
        useSecureCookie - set to true to always user secure cookies, false to disable their use.

      • getAuthenticationDetailsSource

        protected AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,​?> getAuthenticationDetailsSource()

      • setAuthenticationDetailsSource

        public void setAuthenticationDetailsSource​(AuthenticationDetailsSource<javax.servlet.http.HttpServletRequest,​?> authenticationDetailsSource)

      • setUserDetailsChecker

        public void setUserDetailsChecker​(UserDetailsChecker userDetailsChecker)
        Sets the strategy to be used to validate the UserDetails object obtained for the user when processing a remember-me cookie to automatically log in a user.
        Parameters:
        userDetailsChecker - the strategy which will be passed the user object to allow it to be rejected if account should not be allowed to authenticate (if it is locked, for example). Defaults to a AccountStatusUserDetailsChecker instance.

      • setMessageSource

        public void setMessageSource​(org.springframework.context.MessageSource messageSource)
        Specified by:
        setMessageSource in interface org.springframework.context.MessageSourceAware
        Since:
        5.5