dagged

Results 2 comments of dagged

SEC-2856: Make cookie theft detection in remember-me service configurable because it's seriously broken

My fix is to create a CustomRememberMeService which extends PersistentTokenBasedRememberMeServices and overrides the processAutoLoginCookie method. I modify the original method to allow a series to have any token if the...

SEC-2856: Make cookie theft detection in remember-me service configurable because it's seriously broken

I also modify `JdbcTokenRepositoryImpl` to take the oldTokenValue as a parameter in the update. This makes sure only one thread updates the token and sets the new cookie. ``` try...