effect :The application can still remember the user's session when it expires or when the browser is closed. The user can choose whether or not to be remembered. (select at login screen)
What do you mean, "remember"? The next time you visit, go directly to the system without entering your username and password.
Implementation principle:A remember-me cookie is stored in the browser, and when the user accesses the website again through the browser, the site recognizes the Remember-me cookie, which is automatically logged in.
two different ways:① is based on tokens and relies on "cryptographic signatures", i.e. the service side generates a token based on the parameters to compare ② based on persistence and depends on the data store, i.e. the server will retain token
first, Token-based remember-meRemember-me cookie:base64 encoded string, stored in the browser contains the following information:
- User name
- Expiry time
- Md5hash Code (TOKEN/SIGNATURE) + generated by fields such as expiration time, user name, password, <remember-me> element key
Note:The cookie does not contain a password, it is dangerous to include, although the MD5 code is generated by the password field, but MD5 is one-way, almost impossible to be cracked, and not only the password, there are other fields exist
cookies are unreliable and how are they applied to security services? A: You can compare the token in the cookie with the token generated in the background, perform the "check" operation process: ① user Remeber-me cookie to the background, that is, the user name, expiration time, Token② background through the user name to obtain the corresponding password ③ backend profit Generate Token④ with the user name, password, expiration time, key of the <remember-me> element to compare the token generated with the token in the cookie ⑤ if the token is the same, the user will automatically log in to the system
Why is it safe? A: Because if you do not know the key and password is basically impossible to generate tokens, one, key only this application know, write dead in the configuration file, second, the password only users know.is
it absolutely safe? Answer: No, according to the above logic, as long as the token is right, you can log in. This is a problem, if the token is not my use it? Tokens may actually be stolen. Imagine such a situation, a malicious user through the network sniffing, get to a user to send a request when the token, and then he also in a day to send the request when the token, is not directly logged in?
How do you prevent the token from being sniffed? A: Using SSL security protocol, that is, HTTPS, the user and the server connection is secure, send and receive information will not be sniffed.
Ii. Remember-me based on persistent (persistent)Remember-me Cookies:
- Series identifiers (serialized identifier) + = Identifies user initialization login, does not change
- Token + will change every time you use the Remember-me feature (each time you log in automatically changes token)
What is the difference from token-based remember-me? ① Token-based tokens are generated by MD5. Persistent-based tokens are directly based on token-based tokens (or signatures) that are taken from the database, and will not expire unless the expiration time is reached, or if the user changes the password. Tokens based on persistent are expired every time they are exhausted, and the backend generates new tokens stored in the database for the next automatic login.
Spring Security's Remember-me (Remember Me)
