Skip to content

SEC-2429: key in TokenBasedRememberMeServices and RememberMeAuthenticationProvider should be synced #2650

@spring-projects-issues

Description

@spring-projects-issues

Jason Jiang (Migrated from SEC-2429) said:

When I use the namespace to configure spring context for RememberMe, I was confused that it didn't work. After debugging into it, i found my configuration is incorrect but no useful information logged.

The configuration below make the RememberMeAuthenticationProvider and TokenBasedRememberMeServices un-synced. I was trying to fix it and provide a patch. But I am not sure whether override or just warning messages is better. So I will leave it for you guys.

<beans:bean id="rememberMeServices" class="org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
<beans:constructor-arg name="key" value="new_app_key" />
<beans:constructor-arg name="userDetailsService" ref="userService" />/beans:property
/beans:bean

Metadata

Metadata

Assignees

No one assigned

    Labels

    in: configAn issue in spring-security-configtype: enhancementA general enhancementtype: jiraAn issue that was migrated from JIRA

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions