private @ CheckForNull Authentication retrieveAuthFromCookie ( HttpServletRequest request , HttpServletResponse response , String cookieValueBase64 ) { String cookieValue = decodeCookieBase64 ( cookieValueBase64 ) ; if ( cookieValue == null ) { String reason = "Cookie token was not Base64 encoded; value was '" + cookieValueBase64 + "'" ; cancelCookie ( request , response , reason ) ; return null ; } if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Remember-me cookie detected" ) ; } String [ ] cookieTokens = StringUtils . delimitedListToStringArray ( cookieValue , ":" ) ; if ( cookieTokens . length != 3 ) { cancelCookie ( request , response , "Cookie token did not contain 3 tokens separated by [:]" ) ; return null ; } long tokenExpiryTime ; try { tokenExpiryTime = Long . parseLong ( cookieTokens [ 1 ] ) ; } catch ( NumberFormatException nfe ) { cancelCookie ( request , response , "Cookie token[1] did not contain a valid number" ) ; return null ; } if ( isTokenExpired ( tokenExpiryTime ) ) { cancelCookie ( request , response , "Cookie token[1] has expired" ) ; return null ; } // Check the user exists // Defer lookup until after expiry time checked, to // possibly avoid expensive lookup UserDetails userDetails = loadUserDetails ( request , response , cookieTokens ) ; if ( userDetails == null ) { cancelCookie ( request , response , "Cookie token[0] contained a username without user associated" ) ; return null ; } if ( ! isValidUserDetails ( request , response , userDetails , cookieTokens ) ) { return null ; } String receivedTokenSignature = cookieTokens [ 2 ] ; String expectedTokenSignature = makeTokenSignature ( tokenExpiryTime , userDetails ) ; boolean tokenValid = MessageDigest . isEqual ( expectedTokenSignature . getBytes ( StandardCharsets . US_ASCII ) , receivedTokenSignature . getBytes ( StandardCharsets . US_ASCII ) ) ; if ( ! tokenValid ) { cancelCookie ( request , response , "Cookie token[2] contained invalid signature" ) ; return null ; } // By this stage we have a valid token if ( logger . isDebugEnabled ( ) ) { logger . debug ( "Remember-me cookie accepted" ) ; } RememberMeAuthenticationToken auth = new RememberMeAuthenticationToken ( this . getKey ( ) , userDetails , userDetails . getAuthorities ( ) ) ; auth . setDetails ( authenticationDetailsSource . buildDetails ( request ) ) ; return auth ; }
and reducing drastically the information provided in the log to avoid potential disclosure