Java CookieTheftException类代码示例

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
/**
 * Validate the token and return it.
 */
private Token getPersistentToken(String[] cookieTokens) {
    if (cookieTokens.length != 2) {
        throw new InvalidCookieException("Cookie token did not contain " + 2 +
                " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
    }

    final String presentedSeries = cookieTokens[0];
    final String presentedToken = cookieTokens[1];

    Token token = null;
    try {
        token = tokenRepo.findOne(presentedSeries);
    } catch (DataAccessException e) {
        log.error("Error to access database", e );
    }

    if (token == null) {
        // No series match, so we can't authenticate using this cookie
        throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
    }

    // We have a match for this user/series combination
    log.info("presentedToken={} / tokenValue={}", presentedToken, token.getValue());
    if (!presentedToken.equals(token.getValue())) {
        // Token doesn't match series value. Delete this session and throw an exception.
        tokenRepo.delete(token.getSeries());
        throw new CookieTheftException("Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.");
    }

    if (DateUtils.addDays(token.getDate(), TOKEN_VALIDITY_DAYS).before(new Date())) {
        tokenRepo.delete(token.getSeries());
        throw new RememberMeAuthenticationException("Remember-me login has expired");
    }
    return token;
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
/**
 * Validate the token and return it.
 */
private PersistentToken getPersistentToken(String[] cookieTokens) {
    if (cookieTokens.length != 2) {
        throw new InvalidCookieException("Cookie token did not contain " + 2 +
                " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
    }
    String presentedSeries = cookieTokens[0];
    String presentedToken = cookieTokens[1];
    PersistentToken token = persistentTokenRepository.findOne(presentedSeries);

    if (token == null) {
        // No series match, so we can't authenticate using this cookie
        throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
    }

    // We have a match for this user/series combination
    log.info("presentedToken={} / tokenValue={}", presentedToken, token.getTokenValue());
    if (!presentedToken.equals(token.getTokenValue())) {
        // Token doesn't match series value. Delete this session and throw an exception.
        persistentTokenRepository.delete(token);
        throw new CookieTheftException("Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.");
    }

    if (token.getTokenDate().plusDays(TOKEN_VALIDITY_DAYS).isBefore(LocalDate.now())) {
        persistentTokenRepository.delete(token);
        throw new RememberMeAuthenticationException("Remember-me login has expired");
    }
    return token;
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
/**
 * Validate the token and return it.
 */
private Token getPersistentToken(String[] cookieTokens) {
    if (cookieTokens.length != 2) {
        throw new InvalidCookieException("Cookie token did not contain " + 2 + " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
    }

    final String presentedSeries = cookieTokens[0];
    final String presentedToken = cookieTokens[1];

    Token token = persistentTokenService.getPersistentToken(presentedSeries);

    if (token == null) {
        // No series match, so we can't authenticate using this cookie
        throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
    }

    // We have a match for this user/series combination
    if (!presentedToken.equals(token.getTokenValue())) {

        // This could be caused by the opportunity window where the token just has been refreshed, but
        // has not been put into the token cache yet. Invalidate the token and refetch and it the new token value from the db is now returned.

        token = persistentTokenService.getPersistentToken(presentedSeries, true); // Note the 'true' here, which invalidates the cache before fetching
        if (!presentedToken.equals(token.getTokenValue())) {

            // Token doesn't match series value. Delete this session and throw an exception.
            persistentTokenService.delete(token);
            throw new CookieTheftException("Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.");

        }
    }

    if (new Date().getTime() - token.getTokenDate().getTime() > tokenMaxAgeInMilliseconds) {
        throw new RememberMeAuthenticationException("Remember-me login has expired");
    }
    return token;
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
/**
 * Validate the token and return it.
 */
private PersistentToken getPersistentToken(String[] cookieTokens) {
    if (cookieTokens.length != 2) {
        throw new InvalidCookieException("Cookie token did not contain " + 2 +
            " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
    }
    String presentedSeries = cookieTokens[0];
    String presentedToken = cookieTokens[1];
    PersistentToken token = persistentTokenRepository.findOne(presentedSeries);

    if (token == null) {
        // No series match, so we can't authenticate using this cookie
        throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
    }

    // We have a match for this user/series combination
    log.info("presentedToken={} / tokenValue={}", presentedToken, token.getTokenValue());
    if (!presentedToken.equals(token.getTokenValue())) {
        // Token doesn't match series value. Delete this session and throw an exception.
        persistentTokenRepository.delete(token);
        throw new CookieTheftException("Invalid remember-me token (Series/token) mismatch. Implies previous " +
            "cookie theft attack.");
    }

    if (token.getTokenDate().plusDays(TOKEN_VALIDITY_DAYS).isBefore(LocalDate.now())) {
        persistentTokenRepository.delete(token);
        throw new RememberMeAuthenticationException("Remember-me login has expired");
    }
    return token;
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
/**
 * Validate the token and return it.
 */
private PersistentToken getPersistentToken(final String[] cookieTokens) {
	if (cookieTokens.length != 2) {
		throw new InvalidCookieException("Cookie token did not contain " + 2 + " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
	}
	String presentedSeries = cookieTokens[0];
	String presentedToken = cookieTokens[1];
	PersistentToken token = persistentTokenRepository.findOne(presentedSeries);

	if (token == null) {
		// No series match, so we can't authenticate using this cookie
		throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
	}

	// We have a match for this user/series combination
	log.info("presentedToken={} / tokenValue={}", presentedToken, token.getTokenValue());
	if (!presentedToken.equals(token.getTokenValue())) {
		// Token doesn't match series value. Delete this session and throw
		// an exception.
		persistentTokenRepository.delete(token);
		throw new CookieTheftException("Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.");
	}

	if (token.getTokenDate().plusDays(TOKEN_VALIDITY_DAYS).isBefore(LocalDate.now())) {
		persistentTokenRepository.delete(token);
		throw new RememberMeAuthenticationException("Remember-me login has expired");
	}
	return token;
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
@Override
protected UserDetails processAutoLoginCookie(String[] arg0, HttpServletRequest arg1, HttpServletResponse arg2) {
	try {
		return super.processAutoLoginCookie(arg0, arg1, arg2);
	} catch (CookieTheftException cte) {
		log.warn("Instead of throwing CookieTheftException, will convert it to RememberMeAuthenticationException",
				cte);
		// NOTE: It will not prevent all user cookies delition, but still
		// will not show ugly exception to the user, instead it will ask for
		// login
		throw new RememberMeAuthenticationException("Converting CookieTheftException to something less scary");
	}
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
/**
 * Validate the token and return it.
 */
private PersistentToken getPersistentToken(String[] cookieTokens) {
  if (cookieTokens.length != 2) {
    throw new InvalidCookieException(format("Cookie token did not contain %d tokens, but contained '%s'", 2, asList(cookieTokens)));
  }
  String presentedSeries = cookieTokens[0];
  String presentedToken = cookieTokens[1];
  PersistentToken token = persistentTokenRepository.findOne(presentedSeries);

  if (token == null) {
    // No series match, so we can't authenticate using this cookie
    throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
  }

  // We have a match for this user/series combination
  log.info("presentedToken={} / tokenValue={}", presentedToken, token.getTokenValue());
  if (!presentedToken.equals(token.getTokenValue())) {
    // Token doesn't match series value. Delete this session and throw an exception.
    persistentTokenRepository.delete(token);
    throw new CookieTheftException("Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.");
  }

  if (token.getTokenDate().plusDays(TOKEN_VALIDITY_DAYS).isBefore(LocalDate.now())) {
    persistentTokenRepository.delete(token);
    throw new RememberMeAuthenticationException("Remember-me login has expired");
  }
  return token;
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
/**
 * Validate the token and return it.
 */
private PersistentToken getPersistentToken(String[] cookieTokens) {
	if (cookieTokens.length != 2) {
		throw new InvalidCookieException("Cookie token did not contain " + 2 + " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
	}
	final String presentedSeries = cookieTokens[0];
	final String presentedToken = cookieTokens[1];
	final PersistentToken token = persistentTokenRepository.findOne(presentedSeries);

	if (token == null) {
		// No series match, so we can't authenticate using this cookie
		throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
	}

	// We have a match for this user/series combination
	log.info("presentedToken={} / tokenValue={}", presentedToken, token.getTokenValue());
	if (!presentedToken.equals(token.getTokenValue())) {
		// Token doesn't match series value. Delete this session and throw an exception.
		persistentTokenRepository.delete(token);
		throw new CookieTheftException("Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.");
	}

	if (token.getTokenDate().plusDays(TOKEN_VALIDITY_DAYS).isBefore(LocalDate.now())) {
		persistentTokenRepository.delete(token);
		throw new RememberMeAuthenticationException("Remember-me login has expired");
	}
	return token;
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
/**
 * Validate the token and return it.
 */
private PersistentToken getPersistentToken(String[] cookieTokens) {
    if (cookieTokens.length != 2) {
        throw new InvalidCookieException("Cookie token did not contain " + 2 +
                " tokens, but contained '" + Arrays.asList(cookieTokens) + "'");
    }

    final String presentedSeries = cookieTokens[0];
    final String presentedToken = cookieTokens[1];

    PersistentToken token = persistentTokenRepository.findOne(presentedSeries);

    if (token == null) {
        // No series match, so we can't authenticate using this cookie
        throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
    }

    // We have a match for this user/series combination
    log.info("presentedToken={} / tokenValue={}", presentedToken, token.getTokenValue());
    if (!presentedToken.equals(token.getTokenValue())) {
        // Token doesn't match series value. Delete this session and throw an exception.
        persistentTokenRepository.delete(token);
        throw new CookieTheftException("Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.");
    }

    if (token.getTokenDate().plusDays(TOKEN_VALIDITY_DAYS).isBefore(LocalDate.now())) {
        persistentTokenRepository.delete(token);
        throw new RememberMeAuthenticationException("Remember-me login has expired");
    }
    return token;
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
@ExceptionHandler(CookieTheftException.class)
public String handleCookieTheft(Exception e , RedirectAttributes attr) {
    e.printStackTrace();
    attr.addFlashAttribute("error","Your remember me details are invalid. Please log in again.");
    return "redirect:/error";
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
@ExceptionHandler(CookieTheftException.class)
public String handleCookieTheft(Exception e , RedirectAttributes attr) {
    e.printStackTrace();
    attr.addFlashAttribute("error","Your remember me details are invalid. Please log in again.");
    return "redirect:/oups";
}
 

import org.springframework.security.web.authentication.rememberme.CookieTheftException; //导入依赖的package包/类
protected UserDetails processAutoLoginCookie(String[] cookieTokens, HttpServletRequest request,
		HttpServletResponse response) {

	if (cookieTokens.length != 2) {
		throw new InvalidCookieException("Cookie token did not contain " + 2 + " tokens, but contained '"
				+ Arrays.asList(cookieTokens) + "'");
	}

	final String presentedSeries = cookieTokens[0];
	final String presentedToken = cookieTokens[1];

	TenantUserRememberMeToken token = (TenantUserRememberMeToken) tokenRepository
			.getTokenForSeries(presentedSeries);

	if (token == null) {
		throw new RememberMeAuthenticationException("No persistent token found for series id: " + presentedSeries);
	}

	if (!presentedToken.equals(token.getTokenValue())) {

		tokenRepository.removeUserTokens(token.getUserId());

		throw new CookieTheftException(messages.getMessage("PersistentTokenBasedRememberMeServices.cookieStolen",
				"Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack."));
	}

	if (token.getDate().getTime() + getTokenValiditySeconds() * 1000L < System.currentTimeMillis()) {
		throw new RememberMeAuthenticationException("Remember-me login has expired");
	}

	if (logger.isDebugEnabled()) {
		logger.debug("Refreshing persistent login token for user '" + token.getUsername() + "', series '"
				+ token.getSeries() + "'");
	}

	PersistentRememberMeToken newToken = new PersistentRememberMeToken(token.getUsername(), token.getSeries(),
			generateTokenData(), new Date());

	try {
		tokenRepository.updateToken(newToken.getSeries(), newToken.getTokenValue(), newToken.getDate());
		addCookie(newToken, request, response);
	} catch (Exception e) {
		logger.error("Failed to update token: ", e);
		throw new RememberMeAuthenticationException("Autologin failed due to data access problem");
	}

	return getUserDetailsService().loadUserByUsername(token.getTenantUserName());
}