[
https://issues.apache.org/jira/browse/WICKET-7193?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Emond Papegaaij updated WICKET-7193:
------------------------------------
Summary: Deprecate and remove IAuthenticationStrategy (was: Deprecate
IAuthenticationStrategy)
> Deprecate and remove IAuthenticationStrategy
> --------------------------------------------
>
> Key: WICKET-7193
> URL: https://issues.apache.org/jira/browse/WICKET-7193
> Project: Wicket
> Issue Type: Task
> Affects Versions: 11.0.0, 9.23.0, 8.18.0, 10.10.0
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
>
> The interface IAuthenticationStrategy allows saving and loading credentials
> in a cookie. The only implementation DefaultAuthenticationStrategy does
> exactly this. Storing credentials in a cookie (encrypted or not) is a
> questionable practice and there is very little reason for wicket to support
> this out of the box. We should deprecate this interface in all supported
> wicket versions, stating that is retired for security reasons with no
> replacement. In 11 we can remove the interface and implementation and remove
> the 'Remember me' checkbox in SignInPanel in wicket-auth-roles.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
