SEC-2427: Subsequent requests from the same browser break remember me function and throws CookieTheftException

Vertonur Sunimi (Migrated from SEC-2427) said:

Prerequisite: Browser with authenticated rememberme cookie stored.

Reproduction steps:

1. The browser open a page to trigger auto login.
2. Request received by server and processed right before code tokenRepository.updateToken(newToken.getSeries(), newToken.getTokenValue(), newToken.getDate()); of PersistentTokenBasedRememberMeServices and the executing thread paused.
3. End user refresh the page and a second request is sent to the server
4. The second request is recieved and processed through the Spring Security filters and returned a new cookie to the browser and the token( token-A) in the db is updated either.
5. The first request resumed and run code updateToken thus the db is updated with the new generated token (token-B). As the request has been canceled by the browser so token-B will never reach the browser with code addCookie(newToken, request, response);
6. Session of the end user time out and pages are requested again, browser send request s with token-A
7. !presentedToken.equals(token.getTokenValue()) of PersistentTokenBasedRememberMeServices is checked thus caused CookieTheftException be thrown and all tokens related to the end user in db are deleted.

SO concurrency control is needed for rememberme filter.

Start in PersistentTokenBasedRememberMeServices at the tokenRepository.updateToken and addCookie calls described in the reproduction. Recreate the two overlapping auto-login requests, including the canceled first response, and inspect how token-A and token-B are persisted. Done means the concurrent sequence no longer causes CookieTheftException or deletes the user's remember-me tokens.