Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use SessionAuthenticationStrategy for Remember-Me authentication #15748

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Use SessionAuthenticationStrategy for Remember-Me authentication #15748

wants to merge 1 commit into from

Conversation

xhaggi
Copy link

@xhaggi xhaggi commented Sep 6, 2024 •
edited
Loading

As described in gh-2253, the RememberMeAuthenticationFilter does not call the configured SessionAuthenticationStrategy if there is one, and therefore concurrent session control does not work properly.

This PR adapts the RememberMeAuthenticationFilter so that it calls the SessionAuthenticationStrategy on successful authentication as the AbstractAuthenticationProcessingFilter does. The shared SessionAuthenticationStrategy is then used in the RememberMeConfigurer to configure the filter like it is done in FormLoginConfigurer.

Let me know if anything is missing!

@spring-projects-issues spring-projects-issues added the status: waiting-for-triage An issue we've not yet triaged label Sep 6, 2024
jzheaux
jzheaux requested changes Sep 17, 2024
View reviewed changes
Copy link
Contributor

@jzheaux jzheaux left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the PR, @xhaggi! Could you add a unit test that confirms the desired behavior (concurrency control) works, for example when the DSL configures a max number of sessions and the remember me filter exceeds that?

@jzheaux jzheaux self-assigned this Sep 17, 2024
@jzheaux jzheaux added type: enhancement A general enhancement status: waiting-for-feedback We need additional information before we can continue in: web An issue in web modules (web, webmvc) in: config An issue in spring-security-config and removed status: waiting-for-triage An issue we've not yet triaged in: web An issue in web modules (web, webmvc) labels Sep 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@jzheaux jzheaux jzheaux requested changes

Assignees

@jzheaux jzheaux

Labels
in: config An issue in spring-security-config status: waiting-for-feedback We need additional information before we can continue type: enhancement A general enhancement
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@xhaggi @jzheaux @spring-projects-issues