SpringSecurity3.X remember-me

When configuring remember-me in ingSecurity, The remember-me does not work. Follow the instructions in the official documentation, you only need to add the <remember-me/> Configuration in

1 <input id = "_ spring_security_remember_me" name = "_ spring_security_remember_me" type = "checkbox" value = "true"/>

Briefly describe the login process of SpringSecurity:

1 UsernamePasswordAuthenticationFilter: obtains the user name and password information submitted by the user.

2 --> UserDetailsService: encapsulate user objects

3 --> AbstractUserDetailsAuthenticationProvider

4 --> ProviderManager: the Authentication is encapsulated in SecurityContext (by default, ProviderManager clears the Authentication password after successful Authentication, but retains the user name)

5 --> AbstractRememberMeServices: determines whether the request parameter contains the _ spring_security_remember_me parameter. If any of the parameter values is true, on, yes, and 1, the user name and password are saved in the cookie. Otherwise, no processing is performed.

6 --> AccessDecisionManager: determines whether to allow access.

7

After 8, when requesting protected resources, RememberMeAuthenticationFilter first checks whether the Authentication has expired. If it fails, it tries to search for it from the cookie and find it, then re-encapsulate the Authentication.

The problem lies in ProviderManager. Its Boolean attribute eraseCredentialsAfterAuthentication defaults to true. If it is true, the password information in Authentication is cleared after the username and password are verified successfully, however, the condition for saving the cookie by using AbstractRememberMeServices requires that username and password be obtained from the Authentication at the same time, which leads to the fact that AbstractRememberMeServices will never store username and password in the cookie by default, to ensure that username and password can be correctly stored in cookies, we need to modify the eraseCredentialsAfterAuthentication value to false. Fortunately, it is convenient to modify this attribute, as shown below:

1 <authentication-manager erase-credentials = "false">

2 <authentication-provider user-service-ref = "userService">

3 <password-encoder hash = "md5"/>

4 </authentication-provider>

5 </authentication-manager>

1 <remember-me token-validity-seconds = "123456789"/>