Skip to content

SEC-2119: Add a 'parameter' to <remember-me> #31

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 1 commit into from
Closed

SEC-2119: Add a 'parameter' to <remember-me> #31

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion ...rc/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,7 +49,7 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser {
static final String ATT_SUCCESS_HANDLER_REF = "authentication-success-handler-ref";
static final String ATT_TOKEN_VALIDITY = "token-validity-seconds";
static final String ATT_SECURE_COOKIE = "use-secure-cookie";
static final String ATT_FORM_REMEMBERME_PARAMETER = "rememberme-parameter";
static final String ATT_FORM_REMEMBERME_PARAMETER = "remember-me-parameter";

protected final Log logger = LogFactory.getLog(getClass());
private final String key;
Expand Down
2 changes: 1 addition & 1 deletion config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -579,7 +579,7 @@ remember-me.attlist &=
attribute authentication-success-handler-ref {xsd:token}?
remember-me.attlist &=
## The name of the request parameter which toggles remember-me authentication. Defaults to '_spring_security_remember_me'.
attribute rememberme-parameter {xsd:token}?
attribute remember-me-parameter {xsd:token}?

token-repository-ref =
## Reference to a PersistentTokenRepository bean for use with the persistent token remember-me implementation.
Expand Down
4 changes: 2 additions & 2 deletions config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1801,7 +1801,7 @@
</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="rememberme-parameter" type="xs:token">
<xs:attribute name="remember-me-parameter" type="xs:token">
<xs:annotation>
<xs:documentation>The name of the request parameter which toggles remember-me authentication. Defaults to
'_spring_security_remember_me'.
Expand Down Expand Up @@ -2319,4 +2319,4 @@
<xs:enumeration value="LAST"/>
</xs:restriction>
</xs:simpleType>
</xs:schema>
</xs:schema>
10 changes: 5 additions & 5 deletions config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,7 @@ class RememberMeConfigTests extends AbstractHttpConfigTests {
notThrown BeanDefinitionParsingException
}

def 'Default form-parameter is correct'() {
def 'Default remember-me-parameter is correct'() {
httpAutoConfig () {
'remember-me'()
}
Expand All @@ -225,20 +225,20 @@ class RememberMeConfigTests extends AbstractHttpConfigTests {
}

// SEC-2119
def 'Custom form-parameter is supported'() {
def 'Custom remember-me-parameter is supported'() {
httpAutoConfig () {
'remember-me'('rememberme-parameter': 'ourParam')
'remember-me'('remember-me-parameter': 'ourParam')
}

createAppContext(AUTH_PROVIDER_XML)
expect:
rememberMeServices().parameter == 'ourParam'
}

def 'form-parameter cannot be used together with services-ref'() {
def 'remember-me-parameter cannot be used together with services-ref'() {
when:
httpAutoConfig () {
'remember-me'('rememberme-parameter': 'ourParam', 'services-ref': 'ourService')
'remember-me'('remember-me-parameter': 'ourParam', 'services-ref': 'ourService')
}
createAppContext(AUTH_PROVIDER_XML)
then:
Expand Down
4 changes: 2 additions & 2 deletions docs/manual/src/docbook/appendix-namespace.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -842,8 +842,8 @@
<classname>PersistentTokenBasedRememberMeServices</classname> will be used and configured with a
<classname>JdbcTokenRepositoryImpl</classname> instance. </para>
</section>
<section xml:id="nsa-remember-me-rememberme-parameter">
<title><literal>form-parameter</literal></title>
<section xml:id="nsa-remember-me-remember-me-parameter">
<title><literal>remember-me-parameter</literal></title>
<para>The name of the request parameter which toggles remember-me authentication. Defaults to "_spring_security_remember_me".
Maps to the "parameter" property of <classname>AbstractRememberMeServices</classname>.</para>
</section>
Expand Down