spring-projects / spring-projects/spring-security
SEC-2176: PersistentRememberMeToken not Serializable. Incompatible with Spring HttpInvoker.
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Matt Senter (Migrated from SEC-2176) said:
I am using PersistentTokenBasedRememberMeServices, which requires a PersistentTokenRepository, all of which is used to store and retrieve PersistentRememberMeTokens. The problem is that my PersistentTokenRepository is remote, accessed through Spring HttpInvoker. Since the PersistentRememberMeToken is not Serializable, despite all of its properties being Serializable, it simply doesn't work.
Solution: Make PersistentRememberMeToken implement java.io.Serializable.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Locate PersistentRememberMeToken and inspect its declaration and existing property types. Confirm the class can be serialized for the remote PersistentTokenRepository used through Spring HttpInvoker, then run the relevant Spring Security tests or build checks to verify the change.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 68/100