|
@@ -25,27 +25,19 @@ import javax.servlet.http.HttpServletResponse;
|
|
* Implement by a class that is capable of providing a remember-me service.
|
|
* Implement by a class that is capable of providing a remember-me service.
|
|
*
|
|
*
|
|
* <p>
|
|
* <p>
|
|
- * Spring Security filters (namely {@link
|
|
|
|
- * org.springframework.security.ui.AbstractProcessingFilter} and {@link
|
|
|
|
- * org.springframework.security.ui.rememberme.RememberMeProcessingFilter} will call
|
|
|
|
|
|
+ * Spring Security filters (namely {@link org.springframework.security.ui.AbstractProcessingFilter} and
|
|
|
|
+ * {@link org.springframework.security.ui.rememberme.RememberMeProcessingFilter} will call
|
|
* the methods provided by an implementation of this interface.
|
|
* the methods provided by an implementation of this interface.
|
|
- * </p>
|
|
|
|
- *
|
|
|
|
* <p>
|
|
* <p>
|
|
* Implementations may implement any type of remember-me capability they wish.
|
|
* Implementations may implement any type of remember-me capability they wish.
|
|
* Rolling cookies (as per <a href="http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice">
|
|
* Rolling cookies (as per <a href="http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice">
|
|
* http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice</a>)
|
|
* http://fishbowl.pastiche.org/2004/01/19/persistent_login_cookie_best_practice</a>)
|
|
- * can be used, as can simple implementations that don't require a persistent
|
|
|
|
- * store. Implementations also determine the validity period of a remember-me
|
|
|
|
- * cookie. This interface has been designed to accommodate any of these
|
|
|
|
|
|
+ * can be used, as can simple implementations that don't require a persistent store. Implementations also determine
|
|
|
|
+ * the validity period of a remember-me cookie. This interface has been designed to accommodate any of these
|
|
* remember-me models.
|
|
* remember-me models.
|
|
- * </p>
|
|
|
|
- *
|
|
|
|
* <p>
|
|
* <p>
|
|
- * This interface does not define how remember-me services should offer a
|
|
|
|
- * "cancel all remember-me tokens" type capability, as this will be
|
|
|
|
- * implementation specific and requires no hooks into Spring Security.
|
|
|
|
- * </p>
|
|
|
|
|
|
+ * This interface does not define how remember-me services should offer a "cancel all remember-me tokens" type
|
|
|
|
+ * capability, as this will be implementation specific and requires no hooks into Spring Security.
|
|
*
|
|
*
|
|
* @author Ben Alex
|
|
* @author Ben Alex
|
|
* @version $Id$
|
|
* @version $Id$
|
|
@@ -60,11 +52,13 @@ public interface RememberMeServices {
|
|
* whatsoever to determine whether the browser has requested remember-me services or presented a valid cookie.
|
|
* whatsoever to determine whether the browser has requested remember-me services or presented a valid cookie.
|
|
* Such determinations are left to the implementation. If a browser has presented an unauthorised cookie for
|
|
* Such determinations are left to the implementation. If a browser has presented an unauthorised cookie for
|
|
* whatever reason, it should be silently ignored and invalidated using the <code>HttpServletResponse</code>
|
|
* whatever reason, it should be silently ignored and invalidated using the <code>HttpServletResponse</code>
|
|
- * object.<p>The returned <code>Authentication</code> must be acceptable to {@link
|
|
|
|
- * org.springframework.security.AuthenticationManager} or
|
|
|
|
- * {@link org.springframework.security.providers.AuthenticationProvider} defined by the web application. It is recommended {@link
|
|
|
|
- * org.springframework.security.providers.rememberme.RememberMeAuthenticationToken} be used in most cases, as it has a
|
|
|
|
- * corresponding authentication provider.</p>
|
|
|
|
|
|
+ * object.
|
|
|
|
+ * <p>
|
|
|
|
+ * The returned <code>Authentication</code> must be acceptable to
|
|
|
|
+ * {@link org.springframework.security.AuthenticationManager} or
|
|
|
|
+ * {@link org.springframework.security.providers.AuthenticationProvider} defined by the web application.
|
|
|
|
+ * It is recommended {@link org.springframework.security.providers.rememberme.RememberMeAuthenticationToken} be
|
|
|
|
+ * used in most cases, as it has a corresponding authentication provider.
|
|
*
|
|
*
|
|
* @param request to look for a remember-me token within
|
|
* @param request to look for a remember-me token within
|
|
* @param response to change, cancel or modify the remember-me token
|
|
* @param response to change, cancel or modify the remember-me token
|