protected UserDetails processAutoLoginCookie ( String [ ] cookieTokens , HttpServletRequest request , HttpServletResponse response ) { if ( cookieTokens . length != 2 ) { throw new InvalidCookieException ( "Cookie token did not contain " + 2 + " tokens, but contained '" + Arrays . asList ( cookieTokens ) + "'" ) ; } final String presentedSeries = cookieTokens [ 0 ] ; final String presentedToken = cookieTokens [ 1 ] ; PersistentRememberMeToken token = tokenRepository . getTokenForSeries ( presentedSeries ) ; if ( token == null ) { // No series match, so we can't authenticate using this cookie throw new RememberMeAuthenticationException ( "No persistent token found for series id: " + presentedSeries ) ; } // We have a match for this user/series combination if ( ! presentedToken . equals ( token . getTokenValue ( ) ) ) { // Token doesn't match series value. Delete all logins for this user and throw // an exception to warn them. tokenRepository . removeUserTokens ( token . getUsername ( ) ) ; throw new CookieTheftException ( messages . getMessage ( "PersistentTokenBasedRememberMeServices.cookieStolen" , "Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack." ) ) ; } if ( token . getDate ( ) . getTime ( ) + getTokenValiditySeconds ( ) * 1000L < System . currentTimeMillis ( ) ) { throw new RememberMeAuthenticationException ( "Remember-me login has expired" ) ; } // Token also matches, so login is valid. Update the token value, keeping the // *same* series number. if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Refreshing persistent login token for user '" + token . getUsername ( ) + "', series '" + token . getSeries ( ) + "'" ) ; } PersistentRememberMeToken newToken = new PersistentRememberMeToken ( token . getUsername ( ) , token . getSeries ( ) , generateTokenData ( ) , new Date ( ) ) ; try { tokenRepository . updateToken ( newToken . getSeries ( ) , newToken . getTokenValue ( ) , newToken . getDate ( ) ) ; addCookie ( newToken , request , response ) ; } catch ( Exception e ) { logger . error ( "Failed to update token: " , e ) ; throw new RememberMeAuthenticationException ( "Autologin failed due to data access problem" ) ; } return getUserDetailsService ( ) . loadUserByUsername ( token . getUsername ( ) ) ; }
Locates the presented cookie data in the token repository using the series id . If the data compares successfully with that in the persistent store a new token is generated and stored with the same series . The corresponding cookie value is set on the response .