From 999adbc6ee46cf32a6fba139cf380b4bd9214a3f Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Mon, 21 Nov 2011 09:11:17 -0600 Subject: [PATCH] SEC-1827: If use-secure-cookie is set to false explicitly set useSecureCookie to false on AbstractRememberMeServices --- .../config/http/RememberMeBeanDefinitionParser.java | 5 +++-- .../config/http/RememberMeConfigTests.groovy | 13 ++++++++++++- 2 files changed, 15 insertions(+), 3 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java b/config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java index cd751e6f67..17f5f6af58 100644 --- a/config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java +++ b/config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java @@ -98,8 +98,9 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser { services.getPropertyValues().addPropertyValue("userDetailsService", uds); - if ("true".equals(element.getAttribute(ATT_SECURE_COOKIE))) { - services.getPropertyValues().addPropertyValue("useSecureCookie", true); + String useSecureCookie = element.getAttribute(ATT_SECURE_COOKIE); + if (StringUtils.hasText(useSecureCookie)) { + services.getPropertyValues().addPropertyValue("useSecureCookie", Boolean.valueOf(useSecureCookie)); } if (tokenValiditySet) { diff --git a/config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy b/config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy index 72c54dc1a2..7a5abcc6b1 100644 --- a/config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy +++ b/config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy @@ -31,7 +31,7 @@ class RememberMeConfigTests extends AbstractHttpConfigTests { expect: rememberMeServices() instanceof PersistentTokenBasedRememberMeServices - !FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") + FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") == null } def rememberMeServiceWorksWithDataSourceRef() { @@ -112,6 +112,17 @@ class RememberMeConfigTests extends AbstractHttpConfigTests { FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") } + // SEC-1827 + def rememberMeSecureCookieAttributeFalse() { + httpAutoConfig () { + 'remember-me'('key': 'ourkey', 'use-secure-cookie':'false') + } + + createAppContext(AUTH_PROVIDER_XML) + expect: 'useSecureCookie is false' + FieldUtils.getFieldValue(rememberMeServices(), "useSecureCookie") == Boolean.FALSE + } + def 'Negative token-validity is rejected with persistent implementation'() { when: httpAutoConfig () {