Danger, don't feel free to let the website remember password automatically login!

In order to facilitate user login, almost all of the website has realized the "Remember Password", "automatic landing" such as seemingly humanized function.
I also like this function, because my own brain is really hate to remember things.
For the sake of security, my password is very complex, satisfying "number + special symbol + English letter case".
But the password is complex, I always can not remember, want to let the website for me to remember.
But as everyone knows, there is a huge risk behind this.
I first advised everyone: "Dangerous, don't feel free to let the website remember password automatic landing!" ”
To understand the truth of the matter, take a look at how to use cookies to remember that passwords are automatically logged in.

The first step, building form forms

<formclass="Form-signin required-validate"action="${ctx}/login?callbacktype=forward"> ${token} <Div class="Form-group"> <Div class="Row"> <inputclass="Form-control"Type="Text"Autofocusname="username"Value="${username}"Placeholder="Please enter your membership number"/> </Div> </Div> <Div class="Blank10"></Div> <Div class="Form-group"> <Div class="Row"> <inputclass="Form-control"Type="Password" name="Password"Value="${password}"Placeholder="Please enter your login password"/> </Div> </Div> <Div class="Form-group"> <Div class="Row"> <Div class="checkbox"> <label> <input type="checkbox"Value="1"<c:iftest="${issave = = ' true '}"&GT;CHECKED&LT;/C:if>name="Issave"/> Next Automatic login </label> </Div> </Div> </Div> <Div class="Form-group"> <Div class="Row"> <buttonclass="btn btn-lg btn-primary btn-block"Type="Submit"> Login </button> </Div> </Div></form>

Second step, use cookie to remember password when landing

@RequestMapping("/login") PublicModelandviewLogin(HttpServletResponse response, @Requestparam(Value ="username", required =false) String username,@RequestParam(Value ="Password", required =false) String password) {Try{BooleanIssave = Getparatoboolean ("Issave",false); Logger.debug ("Issaved"+ Issave);//try to get cookiesString Cookieuser = cookieutil.getcookiebyname (request, Constants.cookie_user); Logger.debug ("The value of the cookie is:"+ Cookieuser);//Verify user InformationMembers user = Memberservice.selectbyusername (username);//If the IP is different, clear the cookie        if(Cookieuser! =NULL) {if(!user.getlastip (). Equals (Request.getremoteaddr ())) {//Remove automatic login cookie informationCookieutil.removecookie (response, Constants.cookie_user);//Delete cookies}} membersvalidator.checkpassword (password, User.getpassword ()); User.setlastip (Request.getremoteaddr ());//Update login ID and last login timeMemberservice.updatelastvisit (user); Checktoken ();intMax_age = Variables.cookie_expire *3600* -;if(Issave) {//Storing automatic login information in a cookieCookieutil.setcookie (response, Constants.cookie_user, Desutils.encrypt (username +","+ Password +","+ issave), max_age); }Else{//Remove automatic login cookie informationCookieutil.removecookie (response, Constants.cookie_user);//Delete cookies} logger.debug ("Jump after successful landing");returnAjaxdonesuccess (User.getuid (). ToString (), (String) getsessionattr (Constants.before_login_url)); }Catch(Exception e)        {Logger.error (E.getmessage ()); Logger.error (E.getmessage (), E);returnAjaxdoneerror (Constants.server_error); }}

This part of the code is also very clear, not a long explanation.

Attached Cookieutil.java class

/** * Cookie Tool class * */ Public  class cookieutil {    /** * Add a cookie * * @param response * @param name * @param value *< c8> @param MaxAge * /     Public Static void Setcookie(httpservletresponse response, string name, String value,intMaxAge) {Cookie cookie =NewCookie (name, value); Cookie.setpath ("/");if(MaxAge >0) {cookie.setmaxage (maxAge);    } response.addcookie (cookie); }/** * Delete Cookies * * @param response * @param name * *     Public Static void Removecookie(httpservletresponse response, String name) {Cookie UID =NewCookie (Name,NULL); Uid.setpath ("/"); Uid.setmaxage (0);    Response.addcookie (UID); }/** * Get Cookie Value * * @param request * @return  * *     Public StaticStringGetcookiebyname(HttpServletRequest request, String CookieName) {Cookie cookies[] = request.getcookies ();if(Cookies = =NULL) {return NULL; } for(Cookie cookie:cookies) {if(Cookie.getname (). Equals (CookieName)) {returnCookie.getvalue (); }        }return NULL; }}

The third step, remove the login user name, password and other key information from the cookie

@RequestMapping("/initlogin") PublicModelandviewInitlogin() {Logger.debug ("Go to landing page");Try{Modelandview Initview =NewModelandview ("Login"); String Cookieuser = cookieutil.getcookiebyname (request, Constants.cookie_user);if(Cookieuser! =NULL) {String decode = Desutils.decrypt (Cookieuser); string[] Cookieusers = Decode.split (","); Initview.addobject ("username", cookieusers[0]); Initview.addobject ("Password", cookieusers[1]); Initview.addobject ("Issave", cookieusers[2]); } createtoken ();returnInitview; }Catch(Exception e)        {Logger.error (E.getmessage ()); Logger.error (E.getmessage (), E);returnerror300 (Constants.server_error); }}

When I enter the account number, as well as the password, tick "Next automatic Login", then the system after verification passed, will be through the cookie to remember my user name and password, the next time you do not have to enter the account and password, directly click on the login to enter the system.

To this end, the automatic login feature has been implemented.
Well, now it's time to say some responsible things.

In the browser's developer mode, note the "Type= ' password" in the red box, at which point we change the type to text.

Note, notice that you have found that the password is no longer a password, became clear.
Are you in the moment?

Yes, XX (this article will be harmonious, not so, this is not a secret, it is a programmer know) also this!

So, as a casual it dog, I advise you, "dangerous, don't feel free to let the website remember password automatic landing!" ”
If your computer this will be used by me, and you choose to let the website remember the password, I am sorry, you again complex password is just a bunch of clear text!
Sure, I'm not going to see your password.
But the browser will not look at your password I can not guarantee.
Since in order to secure, set up a super-long super complex password, then each time to manually lose it, no trouble, very safe!

It dog, like reading and writing!

Sweep the QR code below to pay attention to the Silence King II public number:

Danger, don't feel free to let the website remember password automatically login!