spring-projects / spring-projects/spring-security
SEC-2456: checking validity of remember-me tokens
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Cemo Koc (Migrated from SEC-2456) said:
We would like to check existence and validity of a remember-me token.
Our use case: User who has a valid token has to be warned in a temporary page about their remember-me status.
Is it good idea to have hasValidToken(Request, UserDetails) method in terms API perspective? I have actually implemented by extending TokenBasedRememberMe service and using its protected methods nicely but thought that It might be useful for others as well.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Review the TokenBasedRememberMe service and the protected methods mentioned in the issue to understand how token existence and validity are currently checked. Determine whether a public hasValidToken(Request, UserDetails) API is appropriate, and define the expected behavior and tests before implementation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- authentication, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100