Set cookie domain for cancel remember-me

[asauvez]

Summary

Following https://jira.spring.io/browse/SEC-3210, we now have the ability to specify the remember-me cookie domain, in order to have the same cookie on en.sample.org and fr.sample.org by example. But If you apply a domain in AbstractRememberMeServices.setCookie(), you should also apply it to cancelCookie().

In order to delete a cookie, one must specify the same domain.

Actual Behavior

1. Specify a domain http.rememberMe().rememberMeCookieDomain(".sample.org");
2. Login with remember me
3. Logout
4. You are still logged, since the remember-me cookie was not deleted.

Expected Behavior

After 3., you should be disconnected.

Version

Spring Security 4.1.0.

Suggested Correction

Pull request asauvez#1

protected void cancelCookie(HttpServletRequest request, HttpServletResponse response) {
    logger.debug("Cancelling cookie");
    Cookie cookie = new Cookie(cookieName, null);
    cookie.setMaxAge(0);
    if (cookieDomain != null) {
        cookie.setDomain(cookieDomain);
    }
    cookie.setPath(getCookiePath(request));

    response.addCookie(cookie);
}

[jgrandja]

Thanks for catching this @asauvez. Would you be able to write a test in AbstractRememberMeServicesTests for this issue?

[jgrandja]

Also, I noticed the referenced PR is in your forked repo. Would you like to submit the PR to the Spring Security repo?

[asauvez]

Done here:
#3878
Thank you for your time and have a nice day.

[rwinch]

Thanks @asauvez! This is now merged into master w/ polish to the formatting and commit comment