[MCCProgrammer]

What

• Sign-in form: a new "Keep me signed in for 30 days" box (remember-me).
• Persistent tokens: Spring Security's PersistentTokenBasedRememberMeServices with JdbcTokenRepositoryImpl, stored in persistent_logins (Flyway V7). The token is random and stored, not a cookie signed with the password hash.
  • Each use replaces the token.
  • Signing out deletes the account's remembered logins and the cookie.
  • The cookie is HttpOnly, and Secure behind HTTPS.
• Stolen-cookie detection (RememberedLogins):
  • If an old token comes back after its renewal, someone has a copy. Spring Security then deletes every remembered login of the account.
  • Spring then throws CookieTheftException, which would end the request in a 500.
  • The subclass logs a warning instead, and the visit carries on signed out (redirect to sign-in).
• Login lifetime: sessions still live in memory, so a deploy ends them. Browsers that ticked the box sign back in by themselves on their next visit.
• Docs: ADR 0015 updated.

Tests

4 new tests in WebsiteSecurityTests:

• Remember and sign out: the cookie lasts 30 days and is HttpOnly. A visit with only the cookie is signed in and gets a new token. Signing out clears the cookie and the stored login, and the renewed cookie no longer works.
• Reused old cookie: both the old and the renewed cookie stop working, and nothing is left in persistent_logins.
• Box not ticked: no cookie is set and nothing is stored.
• Sign-in page: it shows the box.

./mvnw verify passes: 179 tests and the coverage gate. I also checked the page in a browser.

[sonarqubecloud]

Quality Gate passed

Issues
1 New issue
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud