2

I need to implement "Remember me" functionallity on my JSF site, i´ve been researching about this topic trying to find what the best practices are. Ive found many answers, but i still have a question based on the technology i use and the way i store user passwords in my database.

Summarizing what i've found

  • Create a database table containing the user and a hard to guess long serial.
  • When a user logs in with the remember me option checked, generate a registry on the db table and send a cookie to the user with both username and serial in it.
  • In case the same user isnt logged in, and has a valid cookie according to the database, Automatically login the user.

How i actually login users

Based on Java EE standards i use JAAS and i store the MD5 version of user passwords. I login my users through the login method of the HttpServletRequest class which needs a username and a password in order to validate the authentication and set the user principal.

Based on these two facts, how can i do the automatic login based on this best practice if i need both username and password in order to login the user?

Arjan Tijms
  • 37,782
  • 12
  • 108
  • 140
Juan
  • 467
  • 1
  • 5
  • 19

1 Answers1

2

how can i do the automatic login based on this best practice if i need both username and password in order to login the user?

Just get username and password straight from the DB based on the value of the "remember me" cookie. Then you can provide them to the HttpServletRequest#login() method.

Note that the value of the "remember me" cookie should absolutely not contain any hints about the username, password nor ID. It should be an absolutely random value. The java.util.UUID is helpful here.

See also:

Community
  • 1
  • 1
BalusC
  • 1,082,665
  • 372
  • 3,610
  • 3,555
  • Hello @BalusC, thank you for your answer, im not sure if you took in account that all i have in my database is the MD5 version of the user passwords. – Juan Nov 29 '12 at 18:12
  • I'm not sure why that's a problem. – BalusC Nov 29 '12 at 18:14
  • thats a problem because the login method of the HttpServletRequest requires both a username and a password (the password must be the authentic user password in order to be automatically hashed and compared to the MD5 version in the database) – Juan Nov 29 '12 at 18:20
  • I actually have MD5 as password hashing in my realm, should i disable it at the realm level and do it myself? – Juan Nov 29 '12 at 18:42
  • 1
    Oh, this way. Yes, let the code or DB hash it instead of the realm itself. – BalusC Nov 29 '12 at 18:48