Remember-Me Services

In this chapter, we'll add the ability for an application to remember a user even after their session has expired and the browser is closed. The following topics will be covered in this chapter:

• Discussing what remember-me is
• Learning how to use the token-based remember-me feature
• Discussing how secure remember-me is, and various ways of making it more secure
• Enabling the persistent-based remember-me feature, and how to handle additional considerations for using it
• Presenting the overall remember-me architecture
• Learning how to create a custom remember-me implementation that is restricted to the user's IP address

What is remember-me?

A convenient feature to offer frequent users of a website is the remember-me feature. This feature allows a user to elect to be remembered even after their browser is closed. In Spring Security, this is implemented through the use of a remember-me cookie that is stored in the user's browser. If Spring Security recognizes that the user is presenting a remember-me cookie, then the user will automatically be logged into the application, and will not need to enter a username or password.

What is a cookie?
A cookie is a way for a client (that is, a web browser) to persist the state. For more information about cookies, refer to additional online resources, such as Wikipedia (http://en.wikipedia.org/wiki/HTTP_cookie).

Spring Security provides the following two different strategies that we will discuss in this chapter:

• The first is the token-based remember-me...

MD5

MD5 is one of the several well-known cryptographic hash algorithms. Cryptographic hash algorithms compute a compact and unique text representation of input data with arbitrary length, called a digest. This digest can be used to determine if an untrusted input should be trusted by comparing the digest of the untrusted input to a known valid digest of the expected input.

The following diagram illustrates how this works:

For example, many open source software sites allow mirrors to distribute their software to help increase download speeds. However, as a user of the software, we would want to be sure that the software is authentic and doesn't include any viruses. The software distributor will calculate and publish the expected MD5 checksum on their website with their known, good version of the software. Then, we can download the file from any location. Before we install...

Is remember-me secure?

Any feature related to security that has been added for user convenience has the potential to expose our carefully-protected site to a security risk. The remember-me feature, in its default form, runs the risk of the user's cookie being intercepted and reused by a malicious user. The following diagram illustrates how this might happen:

The use of SSL (covered in the Appendix, Additional Reference Material) and other network security techniques can mitigate this type of attack, but be aware that there are other techniques, such as cross-site scripting (XSS), that can steal or compromise a remembered user session. While convenient for the user, we don't want to risk financial or other personal information being inadvertently changed or possibly stolen if the remembered session is misused.

Although we don't cover malicious user behavior in detail...

Configuring the persistent-based remember-me feature

Finally, we'll need to make some brief configuration changes to the rememberMe declaration to point it to the data source we're using, as shown in the following code snippet:

   //src/main/java/com/packtpub/springsecurity/configuration/SecurityConfig.java

   @Autowired
   @SuppressWarnings("SpringJavaAutowiringInspection")
        private DataSource dataSource;
    @Autowired
    private PersistentTokenRepository persistentTokenRepository;
    @Override
    protected void configure(HttpSecurity http) throws Exception {
       ...
       http.rememberMe()
           .key("jbcpCalendar")
           .tokenRepository(persistentTokenRepository)
       ...
    }
    @Bean
    public PersistentTokenRepository persistentTokenRepository() {
       JdbcTokenRepositoryImpl db = new JdbcTokenRepositoryImpl();
       db.setDataSource...

The remember-me architecture

We have gone over the basic architecture of both TokenBasedRememberMeServices and PersistentTokenBasedRememberMeServices, but we have not described the overall architecture. Let's see how all of the remember-me pieces fit together.

The following diagram illustrates the different components involved in the process of validating a token-based remember-me token:

As with any of the Spring Security filters, RememberMeAuthenticationFilter is invoked from within FilterChainProxy. The job of RememberMeAuthenticationFilter is to inspect the request, and if it is of interest, an action is taken. The RememberMeAuthenticationFilter interface will use the RememberMeServices implementation to determine if the user is already logged in. The RememberMeServices interface does this by inspecting the HTTP request for a remember-me cookie that is then validated...

Custom cookie and HTTP parameter names

Curious users may wonder if the expected value of the remember-me form field checkbox to be remember-me, or the cookie name to be remember-me, can be changed to obscure the use of Spring Security. This change can be made in one of two locations. Take a look at the following steps:

1. First, we can add additional methods to the rememberMe method, as follows:

        //src/main/java/com/packtpub/springsecurity/configuration/
        SecurityConfig.java

        http.rememberMe()
               .key("jbcpCalendar")
               .rememberMeParameter("jbcpCalendar-remember-me")
               .rememberMeCookieName("jbcpCalendar-remember-me");

2. Additionally, now that we've declared our own RememberMeServices implementation as a Spring bean, we can simply define more properties to change the checkbox and cookie names...

Summary

This chapter explained and demonstrated the use of the remember-me feature in Spring Security. We started with the most basic setup and learned how to gradually make the feature more secure. Specifically, we learned about a token-based remember-me service and how to configure it. We also explore how persistent-based remember-me services can provide additional security, how it works, and the additional considerations necessary when using them.

We also covered the creation of a custom remember-me implementation that restricts the remember-me token to a specific IP address. We saw various other ways to make the remember-me feature more secure.

Up next is certificate-based authentication, and we will discuss how to use trusted client-side certificates to perform authentication.