[jira] [Issue Comment Deleted] (KYLIN-1709) Shiro - onSuccessfulLogin shiro adds two entries in the response header for remember me cookie.

["amit yatagiri (JIRA)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/KYLIN-1709?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

amit yatagiri updated KYLIN-1709:
---------------------------------
    Comment: was deleted

(was: Please update why is this invalid?)

> Shiro - onSuccessfulLogin shiro adds two entries in the response header for remember me cookie. 
> ------------------------------------------------------------------------------------------------
>
>                 Key: KYLIN-1709
>                 URL: https://issues.apache.org/jira/browse/KYLIN-1709
>             Project: Kylin
>          Issue Type: Improvement
>          Components: General, Web 
>    Affects Versions: v1.2
>            Reporter: amit yatagiri
>            Assignee: Zhong,Jason
>              Labels: shiro,
>
> On successful login, shiro adds two cookie entries one with deleteMe as value and other with the encrypted value.
> Though delete-me value cookie has expired state, it should not be resent in the header. As per the cookie spec, order of the response header should not be relied upon.
> class : AbstractRememberMeManager
> method : 
> public void onSuccessfulLogin(Subject subject, AuthenticationToken token, AuthenticationInfo info) {
>         //always clear any previous identity:
>         forgetIdentity(subject);
>         //now save the new identity:
>         if (isRememberMe(token)) {
>             rememberIdentity(subject, token, info);
>         } else {
>             if (log.isDebugEnabled()) {
>                 log.debug("AuthenticationToken did not indicate RememberMe is requested.  " +
>                         "RememberMe functionality will not be executed for corresponding account.");
>             }
>         }
>     }
> In the above code, forget identity happens every time. Better place is in the else condition(when isNotRememberMe).



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)