fix(login): fixing rememberMe #31530
Open
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Please use a Conventional Commit title format for this PR. For more information, see https://www.conventionalcommits.org/en/v1.0.0/ |
There was a problem hiding this comment.
PR Overview
This PR improves the login flow by enhancing JWT token encryption/decryption, updating remember-me cookie handling, and removing obsolete interceptor classes.
- Updated DefaultAutoLoginWebInterceptor to process remember-me tokens and refresh them if needed
- Modified JWT token generation to encrypt user IDs and updated user retrieval logic in JWToken interface
- Removed deprecated interceptors and streamlined login flows in LoginServiceAPIFactory and LoginFactory
Reviewed Changes
| File | Description |
|---|---|
| dotCMS/src/main/java/com/dotcms/filters/interceptor/dotcms/DefaultAutoLoginWebInterceptor.java | Updated token handling and added token refresh logic based on JWT expiration |
| dotCMS/src/main/java/com/dotcms/auth/providers/jwt/factories/JsonWebTokenFactory.java | Adjusted expiresDate conversion for consistency with Date type |
| dotCMS/src/main/java/com/dotcms/auth/providers/jwt/beans/JWToken.java | Added decryption for user IDs with logging on failure |
| dotCMS/src/main/java/com/dotcms/cms/login/LoginServiceAPIFactory.java | Renamed token processing method and updated remember-me cookie creation logic |
| dotCMS/src/main/java/com/dotmarketing/cms/login/factories/LoginFactory.java | Modified doCookieLogin method to use userId directly and log additional details |
| dotCMS/src/main/java/com/dotcms/filters/interceptor/jwt/JsonWebTokenInterceptor.java | Removed the obsolete JWT interceptor class |
| dotCMS/src/main/java/com/liferay/util/LocaleUtil.java | Updated locale determination logic using PortalUtil.getUser(request) |
| dotcms-integration/src/test/java/com/dotcms/MainSuite1a.java | Removed obsolete JWT interceptor integration tests |
Copilot reviewed 14 out of 14 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (2)
dotCMS/src/main/java/com/dotmarketing/cms/login/factories/LoginFactory.java:95
- There is an extra '+' in the log message ('id:+'); consider removing the extra '+' to improve the log clarity.
SecurityLogger.logInfo(LoginFactory.class,"Successful login name:" + user.getFullName() + " id:+" + user.getUserId() + " email:" + user.getEmailAddress());
dotCMS/src/main/java/com/dotmarketing/cms/login/factories/LoginFactory.java:88
- [nitpick] The attribute WebKeys.CMS_USER is set multiple times in this code block; consider consolidating it to a single call to avoid redundancy.
session.setAttribute(WebKeys.CMS_USER, user);
| } | ||
| // if the token was expiry date is greater than the allowed EXPIREY date, reset it | ||
| // maybe someone updated the configured MAX_AGE_DAYS | ||
| if(token.get().getExpiresDate().after(Date.from(Instant.now().plus(jwtMaxAgeInMillis, ChronoUnit.MILLIS)))) { |
There was a problem hiding this comment.
The comment above this block contains a spelling error ('EXPIREY'); please correct it to 'expiry' for clarity.
Copilot is powered by AI, so mistakes are possible. Review output carefully before use.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This pull request includes several changes aimed at improving the handling of JWT tokens and removing deprecated interceptors. The most important changes include encrypting user IDs in JWT tokens, updating methods for creating and processing remember-me cookies, and removing obsolete classes.
JWT Token Enhancements:
dotCMS/src/main/java/com/dotcms/auth/providers/jwt/JsonWebTokenUtils.java: AddedPublicEncryptionFactoryfor encrypting user IDs in JWT tokens. [1] [2]dotCMS/src/main/java/com/dotcms/auth/providers/jwt/beans/JWToken.java: Decrypts user IDs usingPublicEncryptionFactorybefore loading users. [1] [2]Cookie and Session Management:
dotCMS/src/main/java/com/dotcms/cms/login/LoginServiceAPIFactory.java: Updated methods to create and process remember-me cookies using encrypted user tokens. [1] [2] [3]Removal of Deprecated Interceptors:
dotCMS/src/main/java/com/dotcms/filters/interceptor/cas/CasAutoLoginWebInterceptor.java: Removed the obsoleteCasAutoLoginWebInterceptorclass.dotCMS/src/main/java/com/dotcms/filters/interceptor/jwt/JsonWebTokenInterceptor.java: Removed the obsoleteJsonWebTokenInterceptorclass.Default Auto Login Interceptor Update:
dotCMS/src/main/java/com/dotcms/filters/interceptor/dotcms/DefaultAutoLoginWebInterceptor.java: Enhanced to handle remember-me tokens and refresh tokens if necessary. [1] [2]