Package org.springframework.security.web.authentication.rememberme

# Class RememberMeAuthenticationFilter

java.lang.Object
org.springframework.web.filter.GenericFilterBean
org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter

All Implemented Interfaces:
  `jakarta.servlet.Filter`, `org.springframework.beans.factory.Aware`, `org.springframework.beans.factory.BeanNameAware`, `org.springframework.beans.factory.DisposableBean`, `org.springframework.beans.factory.InitializingBean`, `org.springframework.context.ApplicationEventPublisherAware`, `org.springframework.context.EnvironmentAware`, `org.springframework.core.env.EnvironmentCapable`, `org.springframework.web.context.ServletContextAware`

public class RememberMeAuthenticationFilter extends org.springframework.web.filter.GenericFilterBean implements org.springframework.context.ApplicationEventPublisherAware
Detects if there is no `Authentication` object in the `SecurityContext`, and populates the context with a remember-me authentication token if a `RememberMeServices` implementation so requests.

Concrete `RememberMeServices` implementations will have their `RememberMeServices.autoLogin(HttpServletRequest, HttpServletResponse)` method called by this filter. If this method returns a non-null `Authentication` object, it will be passed to the `AuthenticationManager`, so that any authentication-specific behaviour can be achieved. The resulting `Authentication` (if successful) will be placed into the `SecurityContext`.

If authentication is successful, an `InteractiveAuthenticationSuccessEvent` will be published to the application context. No events will be published if authentication was unsuccessful, because this would generally be recorded via an `AuthenticationManager`-specific application event.

Normally the request will be allowed to proceed regardless of whether authentication succeeds or fails. If some control over the destination for authenticated users is required, an `AuthenticationSuccessHandler` can be injected

## Field Summary

### Fields inherited from class org.springframework.web.filter.GenericFilterBean

`logger`

## Constructor Summary

Constructors
Constructor
Description
`RememberMeAuthenticationFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager, RememberMeServices rememberMeServices)`

## Method Summary

Modifier and Type
Method
Description
`void`
`afterPropertiesSet()`
`void`
`doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain)`
`RememberMeServices`
`getRememberMeServices()`
`protected void`
`onSuccessfulAuthentication(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authResult)`
Called if a remember-me token is presented and successfully authenticated by the `RememberMeServices` `autoLogin` method and the `AuthenticationManager`.
`protected void`
`onUnsuccessfulAuthentication(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException failed)`
Called if the `AuthenticationManager` rejects the authentication object returned from the `RememberMeServices` `autoLogin` method.
`void`
`setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher eventPublisher)`
`void`
`setAuthenticationSuccessHandler(AuthenticationSuccessHandler successHandler)`
Allows control over the destination a remembered user is sent to when they are successfully authenticated.
`void`
`setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)`
Sets the `SecurityContextHolderStrategy` to use.
`void`
`setSecurityContextRepository(SecurityContextRepository securityContextRepository)`
Sets the `SecurityContextRepository` to save the `SecurityContext` on authentication success.
`void`
`setSessionAuthenticationStrategy(SessionAuthenticationStrategy sessionStrategy)`
The session handling strategy which will be invoked immediately after an authentication request is successfully processed by the `AuthenticationManager`.

### Methods inherited from class org.springframework.web.filter.GenericFilterBean

`addRequiredProperty, createEnvironment, destroy, getEnvironment, getFilterConfig, getFilterName, getServletContext, init, initBeanWrapper, initFilterBean, setBeanName, setEnvironment, setServletContext`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Constructor Details

### RememberMeAuthenticationFilter

public RememberMeAuthenticationFilter(org.springframework.security.authentication.AuthenticationManager authenticationManager, RememberMeServices rememberMeServices)

## Method Details

### afterPropertiesSet

public void afterPropertiesSet()

Specified by:
  `afterPropertiesSet` in interface `org.springframework.beans.factory.InitializingBean`
Overrides:
  `afterPropertiesSet` in class `org.springframework.web.filter.GenericFilterBean`

### doFilter

public void doFilter(jakarta.servlet.ServletRequest request, jakarta.servlet.ServletResponse response, jakarta.servlet.FilterChain chain) throws IOException, jakarta.servlet.ServletException

Specified by:
  `doFilter` in interface `jakarta.servlet.Filter`
Throws:
  `IOException`
  `jakarta.servlet.ServletException`

### onSuccessfulAuthentication

protected void onSuccessfulAuthentication(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.Authentication authResult)
Called if a remember-me token is presented and successfully authenticated by the `RememberMeServices` `autoLogin` method and the `AuthenticationManager`.

### onUnsuccessfulAuthentication

protected void onUnsuccessfulAuthentication(jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response, org.springframework.security.core.AuthenticationException failed)
Called if the `AuthenticationManager` rejects the authentication object returned from the `RememberMeServices` `autoLogin` method. This method will not be called when no remember-me token is present in the request and `autoLogin` reurns null.

### getRememberMeServices

public RememberMeServices getRememberMeServices()

### setApplicationEventPublisher

public void setApplicationEventPublisher(org.springframework.context.ApplicationEventPublisher eventPublisher)

Specified by:
  `setApplicationEventPublisher` in interface `org.springframework.context.ApplicationEventPublisherAware`

### setAuthenticationSuccessHandler

public void setAuthenticationSuccessHandler(AuthenticationSuccessHandler successHandler)
Allows control over the destination a remembered user is sent to when they are successfully authenticated. By default, the filter will just allow the current request to proceed, but if an `AuthenticationSuccessHandler` is set, it will be invoked and the `doFilter()` method will return immediately, thus allowing the application to redirect the user to a specific URL, regardless of whatthe original request was for.

Parameters:
  `successHandler` - the strategy to invoke immediately before returning from `doFilter()`.

### setSecurityContextRepository

public void setSecurityContextRepository(SecurityContextRepository securityContextRepository)
Sets the `SecurityContextRepository` to save the `SecurityContext` on authentication success. The default action is not to save the `SecurityContext`.

Parameters:
  `securityContextRepository` - the `SecurityContextRepository` to use. Cannot be null.

### setSecurityContextHolderStrategy

public void setSecurityContextHolderStrategy(org.springframework.security.core.context.SecurityContextHolderStrategy securityContextHolderStrategy)
Sets the `SecurityContextHolderStrategy` to use. The default action is to use the `SecurityContextHolderStrategy` stored in `SecurityContextHolder`.

Since:
  5.8

### setSessionAuthenticationStrategy

public void setSessionAuthenticationStrategy(SessionAuthenticationStrategy sessionStrategy)
The session handling strategy which will be invoked immediately after an authentication request is successfully processed by the `AuthenticationManager`. Used, for example, to handle changing of the session identifier to prevent session fixation attacks.

Parameters:
  `sessionStrategy` - the implementation to use. If not set a null implementation is used.
Since:
  6.4