diff --git a/config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java b/config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java index b3aeeb2ac8..f4b1a9ebf2 100644 --- a/config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java +++ b/config/src/main/java/org/springframework/security/config/http/RememberMeBeanDefinitionParser.java @@ -49,7 +49,7 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser { static final String ATT_SUCCESS_HANDLER_REF = "authentication-success-handler-ref"; static final String ATT_TOKEN_VALIDITY = "token-validity-seconds"; static final String ATT_SECURE_COOKIE = "use-secure-cookie"; - static final String ATT_FORM_PARAMETER = "form-parameter"; + static final String ATT_FORM_REMEMBERME_PARAMETER = "rememberme-parameter"; protected final Log logger = LogFactory.getLog(getClass()); private final String key; @@ -73,7 +73,7 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser { String rememberMeServicesRef = element.getAttribute(ATT_SERVICES_REF); String tokenValiditySeconds = element.getAttribute(ATT_TOKEN_VALIDITY); String useSecureCookie = element.getAttribute(ATT_SECURE_COOKIE); - String formParameter = element.getAttribute(ATT_FORM_PARAMETER); + String remembermeParameter = element.getAttribute(ATT_FORM_REMEMBERME_PARAMETER); Object source = pc.extractSource(element); RootBeanDefinition services = null; @@ -84,12 +84,12 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser { boolean userServiceSet = StringUtils.hasText(userServiceRef); boolean useSecureCookieSet = StringUtils.hasText(useSecureCookie); boolean tokenValiditySet = StringUtils.hasText(tokenValiditySeconds); - boolean formParameterSet = StringUtils.hasText(formParameter); + boolean remembermeParameterSet = StringUtils.hasText(remembermeParameter); - if (servicesRefSet && (dataSourceSet || tokenRepoSet || userServiceSet || tokenValiditySet || useSecureCookieSet || formParameterSet)) { + if (servicesRefSet && (dataSourceSet || tokenRepoSet || userServiceSet || tokenValiditySet || useSecureCookieSet || remembermeParameterSet)) { pc.getReaderContext().error(ATT_SERVICES_REF + " can't be used in combination with attributes " + ATT_TOKEN_REPOSITORY + "," + ATT_DATA_SOURCE + ", " + ATT_USER_SERVICE_REF + ", " + ATT_TOKEN_VALIDITY - + ", " + ATT_SECURE_COOKIE + " or " + ATT_FORM_PARAMETER, source); + + ", " + ATT_SECURE_COOKIE + " or " + ATT_FORM_REMEMBERME_PARAMETER, source); } if (dataSourceSet && tokenRepoSet) { @@ -140,8 +140,8 @@ class RememberMeBeanDefinitionParser implements BeanDefinitionParser { services.getPropertyValues().addPropertyValue("tokenValiditySeconds", tokenValidity); } - if (formParameterSet) { - services.getPropertyValues().addPropertyValue("parameter", formParameter); + if (remembermeParameterSet) { + services.getPropertyValues().addPropertyValue("parameter", remembermeParameter); } services.setSource(source); diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc b/config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc index ff699a4d7c..3cff87ebea 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc +++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.2.rnc @@ -577,7 +577,9 @@ remember-me.attlist &= remember-me.attlist &= ## Reference to an AuthenticationSuccessHandler bean which should be used to handle a successful remember-me authentication. attribute authentication-success-handler-ref {xsd:token}? - +remember-me.attlist &= + ## The name of the request parameter which toggles remember-me authentication. Defaults to '_spring_security_remember_me'. + attribute rememberme-parameter {xsd:token}? token-repository-ref = ## Reference to a PersistentTokenRepository bean for use with the persistent token remember-me implementation. diff --git a/config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd b/config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd index 6ab72e4c04..aa0c860545 100644 --- a/config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd +++ b/config/src/main/resources/org/springframework/security/config/spring-security-3.2.xsd @@ -1801,11 +1801,12 @@ - - - The name of the request parameter which toggles remember-me authentication. Defaults to '_spring_security_remember_me'. - - + + + The name of the request parameter which toggles remember-me authentication. Defaults to + '_spring_security_remember_me'. + + @@ -2318,4 +2319,4 @@ - + \ No newline at end of file diff --git a/config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy b/config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy index e408aeedbe..e9c0ff28d8 100644 --- a/config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy +++ b/config/src/test/groovy/org/springframework/security/config/http/RememberMeConfigTests.groovy @@ -26,6 +26,7 @@ import org.springframework.security.util.FieldUtils import org.springframework.security.web.authentication.SimpleUrlAuthenticationSuccessHandler import org.springframework.security.web.authentication.logout.LogoutFilter import org.springframework.security.web.authentication.logout.SecurityContextLogoutHandler +import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices; import org.springframework.security.web.authentication.rememberme.InMemoryTokenRepositoryImpl import org.springframework.security.web.authentication.rememberme.JdbcTokenRepositoryImpl import org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices @@ -213,10 +214,20 @@ class RememberMeConfigTests extends AbstractHttpConfigTests { notThrown BeanDefinitionParsingException } + def 'Default form-parameter is correct'() { + httpAutoConfig () { + 'remember-me'() + } + + createAppContext(AUTH_PROVIDER_XML) + expect: + rememberMeServices().parameter == AbstractRememberMeServices.DEFAULT_PARAMETER + } + // SEC-2119 def 'Custom form-parameter is supported'() { httpAutoConfig () { - 'remember-me'('form-parameter': 'ourParam') + 'remember-me'('rememberme-parameter': 'ourParam') } createAppContext(AUTH_PROVIDER_XML) @@ -227,7 +238,7 @@ class RememberMeConfigTests extends AbstractHttpConfigTests { def 'form-parameter cannot be used together with services-ref'() { when: httpAutoConfig () { - 'remember-me'('form-parameter': 'ourParam', 'services-ref': 'ourService') + 'remember-me'('rememberme-parameter': 'ourParam', 'services-ref': 'ourService') } createAppContext(AUTH_PROVIDER_XML) then: diff --git a/docs/manual/src/docbook/appendix-namespace.xml b/docs/manual/src/docbook/appendix-namespace.xml index 644c09ef87..2c4390db1e 100644 --- a/docs/manual/src/docbook/appendix-namespace.xml +++ b/docs/manual/src/docbook/appendix-namespace.xml @@ -842,7 +842,7 @@ PersistentTokenBasedRememberMeServices will be used and configured with a JdbcTokenRepositoryImpl instance. -
+
<literal>form-parameter</literal> The name of the request parameter which toggles remember-me authentication. Defaults to "_spring_security_remember_me". Maps to the "parameter" property of AbstractRememberMeServices.