Emond Papegaaij created WICKET-7193:
---------------------------------------
Summary: Deprecate IAuthenticationStrategy
Key: WICKET-7193
URL: https://issues.apache.org/jira/browse/WICKET-7193
Project: Wicket
Issue Type: Task
Affects Versions: 10.10.0, 8.18.0, 9.23.0, 11.0.0
Reporter: Emond Papegaaij
Assignee: Emond Papegaaij
The interface IAuthenticationStrategy allows saving and loading credentials in
a cookie. The only implementation DefaultAuthenticationStrategy does exactly
this. Storing credentials in a cookie (encrypted or not) is a questionable
practice and there is very little reason for wicket to support this out of the
box. We should deprecate this interface in all supported wicket versions,
stating that is retired for security reasons with no replacement. In 11 we can
remove the interface and implementation and remove the 'Remember me' checkbox
in SignInPanel in wicket-auth-roles.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
