AbstractRememberMeServices有两个实现类
| 实现类 | 服务端存储token | 校验后更新token有效期 | cookie内容 |
|---|---|---|---|
| TokenBasedRememberMeServices | 否 | 否 | username, expireTime，token |
| PersistentRememberMeToken | 是 | 是 | series，tokenValue |
TokenBasedRememberMeServices
cookie经Base64解码后，获得字符串数组
image.png
内容分别为username, expireTime，token
这个token是按username:tokenExpiryTime:password:key拼接后进行MD5摘要得到
其中key是RememberMeConfigurer初始化通过UUID随机生成
/**
* Calculates the digital signature to be put in the cookie. Default value is MD5
* ("username:tokenExpiryTime:password:key")
*/
protected String makeTokenSignature(long tokenExpiryTime, String username,
String password) {
String data = username + ":" + tokenExpiryTime + ":" + password + ":" + getKey();
MessageDigest digest;
try {
digest = MessageDigest.getInstance("MD5");
}
catch (NoSuchAlgorithmException e) {
throw new IllegalStateException("No MD5 algorithm available!");
}
return new String(Hex.encode(digest.digest(data.getBytes())));
}
token校验关键点：会再次使用username:tokenExpiryTime:password:key生成token，并与传入的token作比对
此处的password来自userDetails，确保了cookie内容的安全性，并可知若用户更改了密码，该token亦会失效
UserDetails userDetails = getUserDetailsService().loadUserByUsername(
cookieTokens[0]);
Assert.notNull(userDetails, () -> "UserDetailsService " + getUserDetailsService()
+ " returned null for username " + cookieTokens[0] + ". "
+ "This is an interface contract violation");
// Check signature of token matches remaining details.
// Must do this after user lookup, as we need the DAO-derived password.
// If efficiency was a major issue, just add in a UserCache implementation,
// but recall that this method is usually only called once per HttpSession - if
// the token is valid,
// it will cause SecurityContextHolder population, whilst if invalid, will cause
// the cookie to be cancelled.
String expectedTokenSignature = makeTokenSignature(tokenExpiryTime,
userDetails.getUsername(), userDetails.getPassword());
if (!equals(expectedTokenSignature, cookieTokens[2])) {
throw new InvalidCookieException("Cookie token[2] contained signature '"
+ cookieTokens[2] + "' but expected '" + expectedTokenSignature + "'");
}
PersistentTokenBasedRememberMeServices
cookie经Base64解码后，获得字符串数组
image.png
内容分别为series,tokenValue
series,tokenValue均为随机生成的Base64字符串，相当于随机生成一份账密
protected String generateSeriesData() {
byte[] newSeries = new byte[seriesLength];
random.nextBytes(newSeries);
return new String(Base64.getEncoder().encode(newSeries));
}
protected String generateTokenData() {
byte[] newToken = new byte[tokenLength];
random.nextBytes(newToken);
return new String(Base64.getEncoder().encode(newToken));
}
其中series作为key在首次生成后即稳定不变，tokenValue在每次校验后会更新，并与series一同写回cookie
PersistentRememberMeToken newToken = new PersistentRememberMeToken(
token.getUsername(), token.getSeries(), generateTokenData(), new Date());
try {
tokenRepository.updateToken(newToken.getSeries(), newToken.getTokenValue(),
newToken.getDate());
addCookie(newToken, request, response);
}
catch (Exception e) {
logger.error("Failed to update token: ", e);
throw new RememberMeAuthenticationException(
"Autologin failed due to data access problem");
}
series作为key，将整个PersistentRememberMeToken存储在tokenRepository
PersistentRememberMeToken
包含username,series,tokenValue,date
其中date含义为创建时间，用于判断有效期
自动登录时会刷新tokenValue与date
