Skip to content

Commit edbcbf9

Browse files
ngocnhan-tran1996ngocnhan-tran1996
committed
Update Remember-Me example
Related gh-18639 Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>
1 parent 70fc8fe commit edbcbf9

7 files changed

Lines changed: 343 additions & 96 deletions

File tree

‎docs/modules/ROOT/pages/servlet/authentication/rememberme.adoc‎

Lines changed: 3 additions & 96 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,7 @@ This design allows any number of remember-me implementation strategies.
9797
We have seen earlier that Spring Security provides two implementations.
9898
We look at each of these in turn.
9999

100+
[[token-based-remember-me-services]]
100101
=== TokenBasedRememberMeServices
101102
This implementation supports the simpler approach described in <<remember-me-hash-token>>.
102103
`TokenBasedRememberMeServices` generates a `RememberMeAuthenticationToken`, which is processed by `RememberMeAuthenticationProvider`.
@@ -110,105 +111,11 @@ If no `algorithmName` is present, the default matching algorithm will be used, w
110111
You can specify different algorithms for signature encoding and for signature matching, this allows users to safely upgrade to a different encoding algorithm while still able to verify old ones if there is no `algorithmName` present.
111112
To do that you can specify your customized `TokenBasedRememberMeServices` as a Bean and use it in the configuration.
112113

113-
[tabs]
114-
======
115-
Java::
116-
+
117-
[source,java,role="primary"]
118-
----
119-
@Bean
120-
SecurityFilterChain securityFilterChain(HttpSecurity http, RememberMeServices rememberMeServices) throws Exception {
121-
http
122-
.authorizeHttpRequests((authorize) -> authorize
123-
.anyRequest().authenticated()
124-
)
125-
.rememberMe((remember) -> remember
126-
.rememberMeServices(rememberMeServices)
127-
);
128-
return http.build();
129-
}
130-
131-
@Bean
132-
RememberMeServices rememberMeServices(UserDetailsService userDetailsService) {
133-
RememberMeTokenAlgorithm encodingAlgorithm = RememberMeTokenAlgorithm.SHA256;
134-
TokenBasedRememberMeServices rememberMe = new TokenBasedRememberMeServices(myKey, userDetailsService, encodingAlgorithm);
135-
rememberMe.setMatchingAlgorithm(RememberMeTokenAlgorithm.MD5);
136-
return rememberMe;
137-
}
138-
----
139-
140-
XML::
141-
+
142-
[source,xml,role="secondary"]
143-
----
144-
<http>
145-
<remember-me services-ref="rememberMeServices"/>
146-
</http>
147-
148-
<bean id="rememberMeServices" class=
149-
"org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
150-
<property name="userDetailsService" ref="myUserDetailsService"/>
151-
<property name="key" value="springRocks"/>
152-
<property name="matchingAlgorithm" value="MD5"/>
153-
<property name="encodingAlgorithm" value="SHA256"/>
154-
</bean>
155-
----
156-
======
114+
include-code::./CustomAlgorithmRememberMeServicesConfiguration[tag=snippet,indent=0]
157115

158116
The following beans are required in an application context to enable remember-me services:
159117

160-
[tabs]
161-
======
162-
Java::
163-
+
164-
[source,java,role="primary"]
165-
----
166-
@Bean
167-
RememberMeAuthenticationFilter rememberMeFilter() {
168-
RememberMeAuthenticationFilter rememberMeFilter = new RememberMeAuthenticationFilter();
169-
rememberMeFilter.setRememberMeServices(rememberMeServices());
170-
rememberMeFilter.setAuthenticationManager(theAuthenticationManager);
171-
return rememberMeFilter;
172-
}
173-
174-
@Bean
175-
TokenBasedRememberMeServices rememberMeServices() {
176-
TokenBasedRememberMeServices rememberMeServices = new TokenBasedRememberMeServices();
177-
rememberMeServices.setUserDetailsService(myUserDetailsService);
178-
rememberMeServices.setKey("springRocks");
179-
return rememberMeServices;
180-
}
181-
182-
@Bean
183-
RememberMeAuthenticationProvider rememberMeAuthenticationProvider() {
184-
RememberMeAuthenticationProvider rememberMeAuthenticationProvider = new RememberMeAuthenticationProvider();
185-
rememberMeAuthenticationProvider.setKey("springRocks");
186-
return rememberMeAuthenticationProvider;
187-
}
188-
----
189-
190-
XML::
191-
+
192-
[source,xml,role="secondary"]
193-
----
194-
<bean id="rememberMeFilter" class=
195-
"org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter">
196-
<property name="rememberMeServices" ref="rememberMeServices"/>
197-
<property name="authenticationManager" ref="theAuthenticationManager" />
198-
</bean>
199-
200-
<bean id="rememberMeServices" class=
201-
"org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
202-
<property name="userDetailsService" ref="myUserDetailsService"/>
203-
<property name="key" value="springRocks"/>
204-
</bean>
205-
206-
<bean id="rememberMeAuthenticationProvider" class=
207-
"org.springframework.security.authentication.RememberMeAuthenticationProvider">
208-
<property name="key" value="springRocks"/>
209-
</bean>
210-
----
211-
======
118+
include-code::./DefaultAlgorithmRememberMeServicesConfiguration[tag=snippet,indent=0]
212119

213120
Remember to add your `RememberMeServices` implementation to your `UsernamePasswordAuthenticationFilter.setRememberMeServices()` property, include the `RememberMeAuthenticationProvider` in your `AuthenticationManager.setProviders()` list, and add `RememberMeAuthenticationFilter` into your `FilterChainProxy` (typically immediately after your `UsernamePasswordAuthenticationFilter`).
214121

‎docs/src/test/java/org/springframework/security/docs/servlet/authentication/tokenbasedremembermeservices/CustomAlgorithmRememberMeServicesConfiguration.java‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
/*
2+
* Copyright 2026-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.docs.servlet.authentication.tokenbasedremembermeservices;
18+
19+
import org.springframework.context.annotation.Bean;
20+
import org.springframework.context.annotation.Configuration;
21+
import org.springframework.security.config.annotation.web.builders.HttpSecurity;
22+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
23+
import org.springframework.security.core.userdetails.UserDetailsService;
24+
import org.springframework.security.web.SecurityFilterChain;
25+
import org.springframework.security.web.authentication.RememberMeServices;
26+
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices;
27+
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices.RememberMeTokenAlgorithm;
28+
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
29+
30+
/**
31+
* Demonstrates custom algorithm for remember me configuration.
32+
*
33+
* @author Ngoc Nhan
34+
*/
35+
@EnableWebMvc
36+
@EnableWebSecurity
37+
@Configuration(proxyBeanMethods = false)
38+
public class CustomAlgorithmRememberMeServicesConfiguration {
39+
40+
// tag::snippet[]
41+
@Bean
42+
SecurityFilterChain securityFilterChain(HttpSecurity http, RememberMeServices rememberMeServices) throws Exception {
43+
// @formatter:off
44+
http
45+
.authorizeHttpRequests((authorize) -> authorize
46+
.anyRequest().authenticated()
47+
)
48+
.rememberMe((remember) -> remember
49+
.rememberMeServices(rememberMeServices)
50+
);
51+
// @formatter:on
52+
return http.build();
53+
}
54+
55+
@Bean
56+
RememberMeServices rememberMeServices(UserDetailsService userDetailsService) {
57+
RememberMeTokenAlgorithm encodingAlgorithm = RememberMeTokenAlgorithm.SHA256;
58+
TokenBasedRememberMeServices rememberMe = new TokenBasedRememberMeServices("myKey", userDetailsService,
59+
encodingAlgorithm);
60+
rememberMe.setMatchingAlgorithm(RememberMeTokenAlgorithm.MD5);
61+
return rememberMe;
62+
}
63+
// end::snippet[]
64+
65+
}

‎docs/src/test/java/org/springframework/security/docs/servlet/authentication/tokenbasedremembermeservices/DefaultAlgorithmRememberMeServicesConfiguration.java‎

Lines changed: 58 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
/*
2+
* Copyright 2026-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.docs.servlet.authentication.tokenbasedremembermeservices;
18+
19+
import org.springframework.context.annotation.Bean;
20+
import org.springframework.context.annotation.Configuration;
21+
import org.springframework.security.authentication.AuthenticationManager;
22+
import org.springframework.security.authentication.RememberMeAuthenticationProvider;
23+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
24+
import org.springframework.security.core.userdetails.UserDetailsService;
25+
import org.springframework.security.web.authentication.RememberMeServices;
26+
import org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter;
27+
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices;
28+
import org.springframework.web.servlet.config.annotation.EnableWebMvc;
29+
30+
/**
31+
* Demonstrates default algorithm for remember me configuration.
32+
*
33+
* @author Ngoc Nhan
34+
*/
35+
@EnableWebMvc
36+
@EnableWebSecurity
37+
@Configuration(proxyBeanMethods = false)
38+
public class DefaultAlgorithmRememberMeServicesConfiguration {
39+
40+
// tag::snippet[]
41+
@Bean
42+
RememberMeServices rememberMeServices(UserDetailsService userDetailsService) {
43+
return new TokenBasedRememberMeServices("myKey", userDetailsService);
44+
}
45+
46+
@Bean
47+
RememberMeAuthenticationFilter rememberMeFilter(AuthenticationManager authenticationManager,
48+
TokenBasedRememberMeServices rememberMeServices) {
49+
return new RememberMeAuthenticationFilter(authenticationManager, rememberMeServices);
50+
}
51+
52+
@Bean
53+
RememberMeAuthenticationProvider rememberMeAuthenticationProvider() {
54+
return new RememberMeAuthenticationProvider("myKey");
55+
}
56+
// end::snippet[]
57+
58+
}

‎docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/tokenbasedremembermeservices/CustomAlgorithmRememberMeServicesConfiguration.kt‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* Copyright 2026-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.kt.docs.servlet.authentication.tokenbasedremembermeservices
18+
19+
import org.springframework.context.annotation.Bean
20+
import org.springframework.context.annotation.Configuration
21+
import org.springframework.security.config.annotation.web.builders.HttpSecurity
22+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
23+
import org.springframework.security.core.userdetails.UserDetailsService
24+
import org.springframework.security.web.SecurityFilterChain
25+
import org.springframework.security.web.authentication.RememberMeServices
26+
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices
27+
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices.RememberMeTokenAlgorithm
28+
import org.springframework.web.servlet.config.annotation.EnableWebMvc
29+
30+
/**
31+
* Demonstrates custom algorithm for remember me configuration.
32+
*
33+
* @author Ngoc Nhan
34+
*/
35+
@EnableWebMvc
36+
@EnableWebSecurity
37+
@Configuration(proxyBeanMethods = false)
38+
class CustomAlgorithmRememberMeServicesConfiguration {
39+
40+
// tag::snippet[]
41+
@Bean
42+
@Throws(Exception::class)
43+
fun securityFilterChain(http: HttpSecurity, rememberMeServices: RememberMeServices): SecurityFilterChain {
44+
// @formatter:off
45+
http
46+
.authorizeHttpRequests{ it.anyRequest().authenticated() }
47+
.rememberMe { it.rememberMeServices(rememberMeServices) }
48+
// @formatter:on
49+
return http.build()
50+
}
51+
52+
@Bean
53+
fun rememberMeServices(userDetailsService: UserDetailsService): RememberMeServices {
54+
val encodingAlgorithm = RememberMeTokenAlgorithm.SHA256
55+
val rememberMe = TokenBasedRememberMeServices("myKey", userDetailsService, encodingAlgorithm)
56+
rememberMe.setMatchingAlgorithm(RememberMeTokenAlgorithm.MD5)
57+
return rememberMe
58+
}
59+
// end::snippet[]
60+
61+
}

‎docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/tokenbasedremembermeservices/DefaultAlgorithmRememberMeServicesConfiguration.kt‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
/*
2+
* Copyright 2026-present the original author or authors.
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package org.springframework.security.kt.docs.servlet.authentication.tokenbasedremembermeservices
18+
19+
import org.springframework.context.annotation.Bean
20+
import org.springframework.context.annotation.Configuration
21+
import org.springframework.security.authentication.AuthenticationManager
22+
import org.springframework.security.authentication.RememberMeAuthenticationProvider
23+
import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
24+
import org.springframework.security.core.userdetails.UserDetailsService
25+
import org.springframework.security.web.authentication.RememberMeServices
26+
import org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter
27+
import org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices
28+
import org.springframework.web.servlet.config.annotation.EnableWebMvc
29+
30+
/**
31+
* Demonstrates default algorithm for remember me configuration.
32+
*
33+
* @author Ngoc Nhan
34+
*/
35+
@EnableWebMvc
36+
@EnableWebSecurity
37+
@Configuration(proxyBeanMethods = false)
38+
class DefaultAlgorithmRememberMeServicesConfiguration {
39+
40+
// tag::snippet[]
41+
@Bean
42+
fun rememberMeServices(userDetailsService: UserDetailsService): RememberMeServices {
43+
return TokenBasedRememberMeServices("myKey", userDetailsService)
44+
}
45+
46+
@Bean
47+
fun rememberMeFilter(authenticationManager: AuthenticationManager, rememberMeServices: TokenBasedRememberMeServices): RememberMeAuthenticationFilter {
48+
return RememberMeAuthenticationFilter(authenticationManager, rememberMeServices)
49+
}
50+
51+
@Bean
52+
fun rememberMeAuthenticationProvider(): RememberMeAuthenticationProvider {
53+
return RememberMeAuthenticationProvider("myKey")
54+
}
55+
// end::snippet[]
56+
57+
}

0 commit comments

Comments
 (0)