Repository navigation
[JENKINS-16278] "Remember me on this computer" does not work, cookie is not accepted in new session #13196
Description
As of Jenkins version 1.498 the "Remember me" login cookie is not accepted resulting in a necessary login each time a new Jenkins session is started (loss of session cookie). The versions 1.496 and 1.497 did not show this issue.
We are using Jenkin's built-in user authentication
Originally reported by 
lime, imported from: "Remember me on this computer" does not work, cookie is not accepted in new session
- assignee: lime
- status: Resolved
- priority: Major
- component(s): core
- label(s): 1.480.3-fixed, security
- resolution: Fixed
- resolved: 2014-03-11T17:04:06+00:00
- votes: 29
- watchers: 34
- imported: 2025-11-24
Raw content of original issue
As of Jenkins version 1.498 the "Remember me" login cookie is not accepted resulting in a necessary login each time a new Jenkins session is started (loss of session cookie). The versions 1.496 and 1.497 did not show this issue.
We are using Jenkin's built-in user authentication
- environment:
Jenkins 1.498 on Debian Squeeze with Java 1.6.0_26
Activity
jenkins-infra-bot commentedon Jan 11, 2013
Raw content of original comment:
Same Problem occurred in my side...
What's the latest status for this topic?!
jenkins-infra-bot commentedon Jan 15, 2013
Raw content of original comment:
We are experiencing the same issue, but on the LTS version 1.480.2
jenkins-infra-bot commentedon Jan 15, 2013
Raw content of original comment:
commit a9aff08 [SECURITY-49] introduced a change in signature generation for the remember me token in jenkins/core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java:
String expectedTokenSignature = MAC.mac(userDetails.getUsername() + ":" + tokenExpiryTime + ":" + "N/A" + ":" + getKey());
This code is used to VERIFY a cookie sent to Jenkins. The new verification process seems fine, but the change in code is NOT reflected in org.acegisecurity.ui.rememberme.TokenBasedRememberMeServices.class . loginSuccess, where remember me cookies are created and sent to the user. Here, the old signature generation is still being used:
String signatureValue = DigestUtils.md5Hex(username + ":" + expiryTime + ":" + password + ":" + key);
I suggest either @Overriding TokenBasedRememberMeServices.loginSuccess in /jenkins-core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java as well to rely on TokenBasedRememberMeServices2.makeTokenSignature, or revert to the old md5 signature.
Any comments?
jenkins-infra-bot commentedon Jan 15, 2013
Raw content of original comment:
#673
jenkins-infra-bot commentedon Jan 16, 2013
marscher:
Raw content of original comment:
would love to see this pull request in the LTS version, as this affected too.
jenkins-infra-bot commentedon Jan 24, 2013
Raw content of original comment:
Code changed in jenkins
User: Hendrik Millner
Path:
core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java
http://jenkins-ci.org/commit/jenkins/91bbae3c35230734fd2cf6926a7ac1239119fc6e
Log:
[FIXED JENKINS-16278] Fixed RememberMe cookie signature generation (bugfix on SECURITY-49)
New cookie signature generation was not implemented in creation of RememberMe cookie, but only in its verification.
Fixed by new override TokenBasedRememberMeServices2.loginSuccess
jenkins-infra-bot commentedon Jan 24, 2013
Raw content of original comment:
Code changed in jenkins
User: Olivier Lamy
Path:
core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java
http://jenkins-ci.org/commit/jenkins/4325e006d84113f8e100ec59d03f94f98a6ef3a5
Log:
Merge pull request #673 from denebolar/
JENKINS-16278[FIXED JENKINS-16278] Fixed RememberMe cookie signature generation (bugfix on SECURITY-49)
Thanks
Compare: de9002b...4325e00
jenkins-infra-bot commentedon Jan 24, 2013
Raw content of original comment:
Code changed in jenkins
User: Olivier Lamy
Path:
changelog.html
http://jenkins-ci.org/commit/jenkins/0b5a4a3550dcff91b1bedeb77415f683b659634b
Log:
changelog entry for
JENKINS-16278jenkins-infra-bot commentedon Jan 24, 2013
Raw content of original comment:
Olivier Lamy : 0b5a4a3550dcff91b1bedeb77415f683b659634b Files :
Integrated in
jenkins_main_trunk #2213
[FIXED JENKINS-16278] Fixed RememberMe cookie signature generation (bugfix on SECURITY-49) (Revision 91bbae3)
changelog entry for
JENKINS-16278(Revision 0b5a4a3)Result = SUCCESS
hendrik.millner : 91bbae3c35230734fd2cf6926a7ac1239119fc6e
Files :
Olivier Lamy : 0b5a4a3550dcff91b1bedeb77415f683b659634b
Files :
jenkins-infra-bot commentedon Jan 24, 2013
Raw content of original comment:
Please create a new LTS version including this fix.
jenkins-infra-bot commentedon Jan 24, 2013
Raw content of original comment:
@pickgr1 it is already on the 1.480.3 backport candidate list.
jenkins-infra-bot commentedon Jan 24, 2013
Raw content of original comment:
Not sure why this did not already get marked fixed automatically.
jenkins-infra-bot commentedon Jan 25, 2013
Raw content of original comment:
Code changed in jenkins
User: Hendrik Millner
Path:
core/src/main/java/hudson/security/TokenBasedRememberMeServices2.java
http://jenkins-ci.org/commit/jenkins/83c95d51bae57fc328e5b1fb080875234a1b0429
Log:
[FIXED JENKINS-16278] Fixed RememberMe cookie signature generation (bugfix on SECURITY-49)
New cookie signature generation was not implemented in creation of RememberMe cookie, but only in its verification.
Fixed by new override TokenBasedRememberMeServices2.loginSuccess
(cherry picked from commit 91bbae3)
jenkins-infra-bot commentedon Jan 25, 2013
Raw content of original comment:
Code changed in jenkins
User: Olivier Lamy
Path:
changelog.html
http://jenkins-ci.org/commit/jenkins/fa6a84c54506fc25531a039f931870880f6fa182
Log:
changelog entry for
JENKINS-16278(cherry picked from commit 0b5a4a3)Conflicts:
changelog.html
jenkins-infra-bot commentedon Jan 30, 2013
Raw content of original comment:
For which release will this fix be available? I'm at 1.500 and still have to keep logging in over and over.
19 remaining items
jenkins-infra-bot commentedon Dec 6, 2017
Raw content of original comment:
Hi Kim,
May I also ask you to set up a logger according to comment https://issues.jenkins-ci.org/browse/JENKINS-16278?focusedCommentId=174193&page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel#comment-174193 please? It would be great to be sure whether a correct remember me cookie is created, or not.
jenkins-infra-bot commentedon Dec 7, 2017
Raw content of original comment:
Thank you Hendrik, I did set up a logger, here is what appears repeatedly from Jenkins 3.
SecurityContextHolder not populated with remember-me token, as it already contained: 'org.acegisecurity.providers.rememberme.RememberMeAuthenticationToken@edd9cf3c: Username: hudson.security.HudsonPrivateSecurityRealm$Details@7e08bf1b; Password: [PROTECTED]; Authenticated: true; Details: org.acegisecurity.ui.WebAuthenticationDetails@3bcc: RemoteIpAddress: ; SessionId: null; Granted Authorities: authenticated'
And this is the exact same message I get from Jenkins 2.
The entry from Jenkins 1 though is a bit different - note there is a SessionID value:
SecurityContextHolder not populated with remember-me token, as it already contained: 'org.acegisecurity.providers.UsernamePasswordAuthenticationToken@9a1e6431: Username: hudson.security.HudsonPrivateSecurityRealm$Details@305806; Password: [PROTECTED]; Authenticated: true; Details: org.acegisecurity.ui.WebAuthenticationDetails@ffff8868: RemoteIpAddress: ; SessionId: 1sc6t6z8jn1cr2fvqou5qovze; Granted Authorities: authenticated'
jenkins-infra-bot commentedon Dec 7, 2017
Raw content of original comment:
This shows that your authentication is retained by the session ID cookie, at least if it is not null. Does this message look different after you were kicked out from the system? Please check the log on the Jenkins instance, you were kicked out of. Actually, you should be re-authenticated by your session ID cookie, at least as long as you do not close your browser, or any add-on deletes the cookie. Do you have simultaneous session ID cookies for all of your Jenkins instances in your browser, after you logged in into all instances? Or only one cookie for the last instance, you logged into? The session ID cookies expire only when you close your browser.
Anyways, the different Jenkins instances should not be able to influence each other in you browser, especially if they are hosted on different servers. Do you route the Jenkins UIs through one and the same web server, so that the cookies from the different instances may collide (e.g. http://myserver/jenkins1/ and http://myserver/jenkins2/) ?
jenkins-infra-bot commentedon Dec 13, 2017
Raw content of original comment:
So, I am now noticing that it appears that I'm only running into an issue when I attempt to stay logged into the older Jenkins 1 alongside one of the newer Jenkins 2/3. Lately appears that if I'm only trying to stay logged into either Jenkins 2/3 I stay logged in, but I can't maintain a login with Jenkins 1 and Jenkins 2/3.
jenkins-infra-bot commentedon Dec 14, 2017
Raw content of original comment:
I am sorry, I cannot help you without further and deeper insight into your system (browser/ server). It seems you have a problem with the Jenkins cookies in general, not with the remember me token in particular.
jenkins-infra-bot commentedon Nov 24, 2025
[Original
relates_tofrom Jira: JENKINS-9258]jenkins-infra-bot commentedon Nov 24, 2025
[Original
depends_onfrom Jira: JENKINS-17060]