Package org.springframework.security.web.authentication.rememberme

# Class AbstractRememberMeServices

java.lang.Object
org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices

All Implemented Interfaces:
  `org.springframework.beans.factory.Aware`, `org.springframework.beans.factory.InitializingBean`, `org.springframework.context.MessageSourceAware`, `LogoutHandler`, `RememberMeServices`

Direct Known Subclasses:
  `PersistentTokenBasedRememberMeServices`, `TokenBasedRememberMeServices`

public abstract class AbstractRememberMeServices extends Object implements RememberMeServices, org.springframework.beans.factory.InitializingBean, LogoutHandler, org.springframework.context.MessageSourceAware
Base class for RememberMeServices implementations.

Since:
  2.0

## Field Summary

Fields
Modifier and Type
Field
Description
`static final String`
`DEFAULT_PARAMETER`
`protected final org.apache.commons.logging.Log`
`logger`
`protected org.springframework.context.support.MessageSourceAccessor`
`messages`
`static final String`
`SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY`
`static final int`
`TWO_WEEKS_S`

## Constructor Summary

Constructors
Modifier
Constructor
Description
`protected`
`AbstractRememberMeServices(String key, org.springframework.security.core.userdetails.UserDetailsService userDetailsService)`

## Method Summary

Modifier and Type
Method
Description
`void`
`afterPropertiesSet()`
`org.springframework.security.core.Authentication`
`autoLogin(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Template implementation which locates the Spring Security cookie, decodes it into a delimited array of tokens and submits it to subclasses for processing via the `processAutoLoginCookie` method.
`protected void`
`cancelCookie(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Sets a "cancel cookie" (with maxAge = 0) on the response to disable persistent logins.
`protected org.springframework.security.core.Authentication`
`createSuccessfulAuthentication(jakarta.servlet.http.HttpServletRequest request, org.springframework.security.core.userdetails.UserDetails user)`
Creates the final `Authentication` object returned from the `autoLogin` method.
`protected String[]`
`decodeCookie(String cookieValue)`
Decodes the cookie and splits it into a set of token strings using the ":" delimiter.
`protected String`
`encodeCookie(String[] cookieTokens)`
Inverse operation of decodeCookie.
`protected String`
`extractRememberMeCookie(jakarta.servlet.http.HttpServletRequest request)`
Locates the Spring Security remember me cookie in the request and returns its value.
`protected org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,?>`
`getAuthenticationDetailsSource()`
`protected String`
`getCookieName()`
`String`
`getKey()`
`String`
`getParameter()`
`protected int`
`getTokenValiditySeconds()`
`protected org.springframework.security.core.userdetails.UserDetailsService`
`getUserDetailsService()`
`void`
`loginFail(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid.
`void`
`loginSuccess(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication successfulAuthentication)`
Called whenever an interactive authentication attempt is successful.
`void`
`logout(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authentication)`
Implementation of `LogoutHandler`.
`protected void`
`onLoginFail(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
`protected abstract void`
`onLoginSuccess(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication successfulAuthentication)`
Called from loginSuccess when a remember-me login has been requested.
`protected abstract org.springframework.security.core.userdetails.UserDetails`
`processAutoLoginCookie(String[] cookieTokens, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Called from autoLogin to process the submitted persistent login cookie.
`protected boolean`
`rememberMeRequested(jakarta.servlet.http.HttpServletRequest request, String parameter)`
Allows customization of whether a remember-me login has been requested.
`void`
`setAlwaysRemember(boolean alwaysRemember)`
`void`
`setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,?> authenticationDetailsSource)`
`void`
`setAuthoritiesMapper(org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper authoritiesMapper)`
`protected void`
`setCookie(String[] tokens, int maxAge, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Sets the cookie on the response.
`void`
`setCookieCustomizer(Consumer<jakarta.servlet.http.Cookie> cookieCustomizer)`
Sets the `Consumer`, allowing customization of cookie.
`void`
`setCookieDomain(String cookieDomain)`
`void`
`setCookieName(String cookieName)`
`void`
`setMessageSource(org.springframework.context.MessageSource messageSource)`
`void`
`setParameter(String parameter)`
Sets the name of the parameter which should be checked for to see if a remember-me has been requested during a login request.
`void`
`setTokenValiditySeconds(int tokenValiditySeconds)`
`void`
`setUserDetailsChecker(org.springframework.security.core.userdetails.UserDetailsChecker userDetailsChecker)`
Sets the strategy to be used to validate the `UserDetails` object obtained for the user when processing a remember-me cookie to automatically log in a user.
`void`
`setUseSecureCookie(boolean useSecureCookie)`
Whether the cookie should be flagged as secure or not.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY

public static final String SPRING_SECURITY_REMEMBER_ME_COOKIE_KEY

See Also:
  - Constant Field Values

### DEFAULT_PARAMETER

public static final String DEFAULT_PARAMETER

See Also:
  - Constant Field Values

### TWO_WEEKS_S

public static final int TWO_WEEKS_S

See Also:
  - Constant Field Values

### logger

protected final org.apache.commons.logging.Log logger

### messages

protected org.springframework.context.support.MessageSourceAccessor messages

## Constructor Details

### AbstractRememberMeServices

protected AbstractRememberMeServices(String key, org.springframework.security.core.userdetails.UserDetailsService userDetailsService)

## Method Details

### afterPropertiesSet

public void afterPropertiesSet()

Specified by:
  `afterPropertiesSet` in interface `org.springframework.beans.factory.InitializingBean`

### autoLogin

public org.springframework.security.core.Authentication autoLogin(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
Template implementation which locates the Spring Security cookie, decodes it into a delimited array of tokens and submits it to subclasses for processing via the `processAutoLoginCookie` method.

The returned username is then used to load the UserDetails object for the user, which in turn is used to create a valid authentication token.

Specified by:
  `autoLogin` in interface `RememberMeServices`
Parameters:
  `request` - to look for a remember-me token within
  `response` - to change, cancel or modify the remember-me token
Returns:
  a valid authentication object, or `null` if the request should not be authenticated

### extractRememberMeCookie

protected String extractRememberMeCookie(jakarta.servlet.http.HttpServletRequest request)
Locates the Spring Security remember me cookie in the request and returns its value. The cookie is searched for by name and also by matching the context path to the cookie path.

Parameters:
  `request` - the submitted request which is to be authenticated
Returns:
  the cookie value (if present), null otherwise.

### createSuccessfulAuthentication

protected org.springframework.security.core.Authentication createSuccessfulAuthentication(jakarta.servlet.http.HttpServletRequest request, org.springframework.security.core.userdetails.UserDetails user)
Creates the final `Authentication` object returned from the `autoLogin` method.

By default it will create a `RememberMeAuthenticationToken` instance.

Parameters:
  `request` - the original request. The configured `AuthenticationDetailsSource` will use this to build the details property of the returned object.
  `user` - the `UserDetails` loaded from the `UserDetailsService`. This will be stored as the principal.
Returns:
  the `Authentication` for the remember-me authenticated user

### decodeCookie

protected String[] decodeCookie(String cookieValue) throws InvalidCookieException
Decodes the cookie and splits it into a set of token strings using the ":" delimiter.

Parameters:
  `cookieValue` - the value obtained from the submitted cookie
Returns:
  the array of tokens.
Throws:
  `InvalidCookieException` - if the cookie was not base64 encoded.

### encodeCookie

protected String encodeCookie(String[] cookieTokens)
Inverse operation of decodeCookie.

Parameters:
  `cookieTokens` - the tokens to be encoded.
Returns:
  base64 encoding of the tokens concatenated with the ":" delimiter.

### loginFail

public void loginFail(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
Description copied from interface: `RememberMeServices`
Called whenever an interactive authentication attempt was made, but the credentials supplied by the user were missing or otherwise invalid. Implementations should invalidate any and all remember-me tokens indicated in the `HttpServletRequest`.

Specified by:
  `loginFail` in interface `RememberMeServices`
Parameters:
  `request` - that contained an invalid authentication request
  `response` - to change, cancel or modify the remember-me token

### onLoginFail

protected void onLoginFail(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)

### loginSuccess

public void loginSuccess(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication successfulAuthentication)
Called whenever an interactive authentication attempt is successful. An implementation may automatically set a remember-me token in the `HttpServletResponse`, although this is not recommended. Instead, implementations should typically look for a request parameter that indicates the browser has presented an explicit request for authentication to be remembered, such as the presence of a HTTP POST parameter.

Examines the incoming request and checks for the presence of the configured "remember me" parameter. If it's present, or if `alwaysRemember` is set to true, calls `onLoginSuccess`.

Specified by:
  `loginSuccess` in interface `RememberMeServices`
Parameters:
  `request` - that contained the valid authentication request
  `response` - to change, cancel or modify the remember-me token
  `successfulAuthentication` - representing the successfully authenticated principal

### onLoginSuccess

protected abstract void onLoginSuccess(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication successfulAuthentication)
Called from loginSuccess when a remember-me login has been requested. Typically implemented by subclasses to set a remember-me cookie and potentially store a record of it if the implementation requires this.

### rememberMeRequested

protected boolean rememberMeRequested(jakarta.servlet.http.HttpServletRequest request, String parameter)
Allows customization of whether a remember-me login has been requested. The default is to return true if `alwaysRemember` is set or the configured parameter name has been included in the request and is set to the value "true".

Parameters:
  `request` - the request submitted from an interactive login, which may include additional information indicating that a persistent login is desired.
  `parameter` - the configured remember-me parameter name.
Returns:
  true if the request includes information indicating that a persistent login has been requested.

### processAutoLoginCookie

protected abstract org.springframework.security.core.userdetails.UserDetails processAutoLoginCookie(String[] cookieTokens, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response) throws RememberMeAuthenticationException, org.springframework.security.core.userdetails.UsernameNotFoundException
Called from autoLogin to process the submitted persistent login cookie. Subclasses should validate the cookie and perform any additional management required.

Parameters:
  `cookieTokens` - the decoded and tokenized cookie value
  `request` - the request
  `response` - the response, to allow the cookie to be modified if required.
Returns:
  the UserDetails for the corresponding user account if the cookie was validated successfully.
Throws:
  `RememberMeAuthenticationException` - if the cookie is invalid or the login is invalid for some other reason.
  `org.springframework.security.core.userdetails.UsernameNotFoundException` - if the user account corresponding to the login cookie couldn't be found (for example if the user has been removed from the system).

### cancelCookie

protected void cancelCookie(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
Sets a "cancel cookie" (with maxAge = 0) on the response to disable persistent logins.

### setCookie

protected void setCookie(String[] tokens, int maxAge, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
Sets the cookie on the response. By default a secure cookie will be used if the connection is secure. You can set the `useSecureCookie` property to `false` to override this. If you set it to `true`, the cookie will always be flagged as secure. By default the cookie will be marked as HttpOnly.

Parameters:
  `tokens` - the tokens which will be encoded to make the cookie value.
  `maxAge` - the value passed to `Cookie.setMaxAge(int)`
  `request` - the request
  `response` - the response to add the cookie to.

### logout

public void logout(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authentication)
Implementation of `LogoutHandler`. Default behaviour is to call `cancelCookie()`.

Specified by:
  `logout` in interface `LogoutHandler`
Parameters:
  `request` - the HTTP request
  `response` - the HTTP response
  `authentication` - the current principal details

### setCookieName

public void setCookieName(String cookieName)

### setCookieDomain

public void setCookieDomain(String cookieDomain)

### getCookieName

protected String getCookieName()

### setAlwaysRemember

public void setAlwaysRemember(boolean alwaysRemember)

### setParameter

public void setParameter(String parameter)
Sets the name of the parameter which should be checked for to see if a remember-me has been requested during a login request. This should be the same name you assign to the checkbox in your login form.

Parameters:
  `parameter` - the HTTP request parameter

### getParameter

public String getParameter()

### getUserDetailsService

protected org.springframework.security.core.userdetails.UserDetailsService getUserDetailsService()

### getKey

public String getKey()

### setTokenValiditySeconds

public void setTokenValiditySeconds(int tokenValiditySeconds)

### getTokenValiditySeconds

protected int getTokenValiditySeconds()

### setUseSecureCookie

public void setUseSecureCookie(boolean useSecureCookie)
Whether the cookie should be flagged as secure or not. Secure cookies can only be sent over an HTTPS connection and thus cannot be accidentally submitted over HTTP where they could be intercepted.

By default the cookie will be secure if the request is secure. If you only want to use remember-me over HTTPS (recommended) you should set this property to `true`.

Parameters:
  `useSecureCookie` - set to `true` to always user secure cookies, `false` to disable their use.

### getAuthenticationDetailsSource

protected org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,?> getAuthenticationDetailsSource()

### setAuthenticationDetailsSource

public void setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest,?> authenticationDetailsSource)

### setUserDetailsChecker

public void setUserDetailsChecker(org.springframework.security.core.userdetails.UserDetailsChecker userDetailsChecker)
Sets the strategy to be used to validate the `UserDetails` object obtained for the user when processing a remember-me cookie to automatically log in a user.

Parameters:
  `userDetailsChecker` - the strategy which will be passed the user object to allow it to be rejected if account should not be allowed to authenticate (if it is locked, for example). Defaults to a `AccountStatusUserDetailsChecker` instance.

### setAuthoritiesMapper

public void setAuthoritiesMapper(org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper authoritiesMapper)

### setMessageSource

public void setMessageSource(org.springframework.context.MessageSource messageSource)

Specified by:
  `setMessageSource` in interface `org.springframework.context.MessageSourceAware`
Since:
  5.5

### setCookieCustomizer

public void setCookieCustomizer(Consumer<jakarta.servlet.http.Cookie> cookieCustomizer)
Sets the `Consumer`, allowing customization of cookie.

Parameters:
  `cookieCustomizer` - customize for cookie
Since:
  6.4