This is an automated email from the ASF dual-hosted git repository.
papegaaij pushed a commit to branch wicket-10.x
in repository https://gitbox.apache.org/repos/asf/wicket.git
The following commit(s) were added to refs/heads/wicket-10.x by this push:
new 7c955be615 WICKET-7193 Deprecate the authentication strategy and the
remember-me panel
7c955be615 is described below
commit 7c955be615655e7fd930d3c589d58c14b940e835
Author: Emond Papegaaij <[email protected]>
AuthorDate: Fri Aug 21 12:13:17 2026 +0200
WICKET-7193 Deprecate the authentication strategy and the remember-me panel
IAuthenticationStrategy exists to persist sign-in credentials so that a
later
visit signs the user in automatically. Its contract is credential-shaped and
cannot be anything else: load() hands its result straight to
AuthenticatedWebSession.signIn(String, String), so what is stored on the
client
is the password, replayed on every visit for as long as the cookie lives.
DefaultAuthenticationStrategy, the only real implementation, joins the
username
and the password with "-sep-" and writes them to a cookie named LoggedIn.
That
cookie is HttpOnly and SameSite=Lax, but it has no Secure attribute and a
thirty
day lifetime, and it is encrypted with PBEWithMD5AndDES -- DES in an
unauthenticated mode -- under a key regenerated on every restart. Anyone who
obtains it can sign in as the user, and the fixed separator is a crib for
recovering the password itself.
None of that is a defect in the implementation. AuthenticatedWebSession
already
documents that a cookie based login "may not rely on putting username and
password into the cookie but something else that safely identifies the
user",
and this contract cannot express that: load() returns credentials for
authenticate(String, String) to check, so a token could only be carried by
making
the application accept that token as a password. There is no replacement
and no
configuration that makes it safe, which is the second case SECURITY.md
describes
-- the design rather than the implementation is the problem, so it is
deprecated
with no replacement offered.
Deprecating the strategy alone would not be enough. SECURITY.md is explicit
that
deprecating a member does not deprecate the behaviour behind it where the
feature
is still reachable without the application opting in, and an application
that
writes new SignInPanel("signInPanel") -- as SignInPage does -- gets
credential
persistence without naming a single deprecated member. Rather than change a
default on a supported release line, SignInPanel and SignInPage are
deprecated as
well, and UsernamePasswordPanel and UsernamePasswordPage are added in their
place: naming a deprecated class is something an application does
deliberately,
which is what SECURITY.md excludes.
The new types are copies with the remember-me support removed and
everything else
kept, including the package, the member names, the "signInForm" component
id, the
signInFailed resource key and all nine localizations, so migrating is a
change of
type name. Nothing else changes: this commit adds annotations, javadoc and
two new
types; no default is flipped and no behaviour moves.
Two properties of SignInPanel's remember-me support are named in its
javadoc and
deliberately left as they are, because the remedy is to stop using the panel
rather than to harden something that is being removed. Passing false to
SignInPanel(String, boolean) only hides the checkbox -- rememberMe still
starts
out true and an invisible form component is never updated from the request,
so
the credentials are persisted on every successful sign in regardless. And
onConfigure() consults neither flag, so any instance of the panel signs a
visitor
in from an existing cookie.
The removal happens in Wicket 11.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
---
.../authroles/authentication/pages/SignInPage.java | 13 ++
.../authentication/pages/UsernamePasswordPage.html | 12 ++
.../{SignInPage.java => UsernamePasswordPage.java} | 15 +-
.../pages/UsernamePasswordPage_de.html | 12 ++
.../pages/UsernamePasswordPage_fr.html | 28 +++
.../pages/UsernamePasswordPage_hu.html | 28 +++
.../pages/UsernamePasswordPage_pl.html | 12 ++
.../pages/UsernamePasswordPage_ru.html | 28 +++
.../authentication/panel/SignInPanel.java | 32 +++-
.../panel/UsernamePasswordPanel.html | 37 ++++
.../panel/UsernamePasswordPanel.java | 193 +++++++++++++++++++++
.../panel/UsernamePasswordPanel_de.html | 41 +++++
.../panel/UsernamePasswordPanel_de.properties | 15 ++
.../panel/UsernamePasswordPanel_fr.html | 37 ++++
.../panel/UsernamePasswordPanel_fr.properties.xml | 21 +++
.../panel/UsernamePasswordPanel_hu.html | 37 ++++
.../panel/UsernamePasswordPanel_hu.properties | 15 ++
.../panel/UsernamePasswordPanel_ja.html | 37 ++++
.../panel/UsernamePasswordPanel_ko.html | 37 ++++
.../panel/UsernamePasswordPanel_nl.html | 41 +++++
.../panel/UsernamePasswordPanel_nl.properties | 15 ++
.../panel/UsernamePasswordPanel_pl.html | 41 +++++
.../panel/UsernamePasswordPanel_pl.properties | 15 ++
.../panel/UsernamePasswordPanel_ru.html | 37 ++++
.../panel/UsernamePasswordPanel_ru.properties | 15 ++
.../panel/UsernamePasswordPanel_zh_CN.html | 41 +++++
.../authentication/panel/SignInPanelTest.java | 1 +
...nelTest.java => UsernamePasswordPanelTest.java} | 76 +++++++-
.../authentication/IAuthenticationStrategy.java | 25 +++
.../strategy/DefaultAuthenticationStrategy.java | 12 ++
.../strategy/NoOpAuthenticationStrategy.java | 4 +
.../apache/wicket/protocol/http/WebSession.java | 3 +
.../apache/wicket/settings/SecuritySettings.java | 10 +-
33 files changed, 969 insertions(+), 17 deletions(-)
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
index 44bf6a708e..1cde5d5b8c 100644
---
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
@@ -23,9 +23,22 @@ import
org.apache.wicket.request.mapper.parameter.PageParameters;
/**
* A base class which provide standard functionality for sign in.
+ * <p>
+ * <strong>This page is deprecated for security reasons.</strong> It hosts a
{@link SignInPanel},
+ * whose "remember me" support stores the username and the password in a
cookie on the client. Use
+ * {@link UsernamePasswordPage} instead, which hosts a
+ * {@link
org.apache.wicket.authroles.authentication.panel.UsernamePasswordPanel} and is
otherwise
+ * the same page. See {@link SignInPanel} for the mechanism and {@code
SECURITY.md} for the scope
+ * this places the page in.
+ * </p>
*
* @author Jonathan Locke
+ * @deprecated use {@link UsernamePasswordPage}, which is this page without
the "remember me" option.
+ * Persisting credentials on the client cannot be made safe, so
this page is removed in
+ * Wicket 11.
*/
+@Deprecated(since = "8.19.0, 9.24.0, 10.11.0", forRemoval = true)
+@SuppressWarnings("removal")
public class SignInPage extends WebPage
{
private static final long serialVersionUID = 1L;
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.html
new file mode 100644
index 0000000000..a4ebdfcd8a
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.html
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Sign In</title>
+</head>
+<body>
+ <h2>Sign In</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.java
similarity index 78%
copy from
wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
copy to
wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.java
index 44bf6a708e..e12801299f 100644
---
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/SignInPage.java
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage.java
@@ -16,24 +16,25 @@
*/
package org.apache.wicket.authroles.authentication.pages;
-import org.apache.wicket.authroles.authentication.panel.SignInPanel;
+import org.apache.wicket.authroles.authentication.panel.UsernamePasswordPanel;
import org.apache.wicket.markup.html.WebPage;
import org.apache.wicket.request.mapper.parameter.PageParameters;
/**
- * A base class which provide standard functionality for sign in.
+ * A base class which provide standard functionality for sign in, by hosting a
+ * {@link UsernamePasswordPanel}.
*
* @author Jonathan Locke
*/
-public class SignInPage extends WebPage
+public class UsernamePasswordPage extends WebPage
{
private static final long serialVersionUID = 1L;
/**
* Construct
*/
- public SignInPage()
+ public UsernamePasswordPage()
{
this(null);
}
@@ -44,8 +45,10 @@ public class SignInPage extends WebPage
* @param parameters
* The page parameters
*/
- public SignInPage(final PageParameters parameters)
+ public UsernamePasswordPage(final PageParameters parameters)
{
- add(new SignInPanel("signInPanel"));
+ super(parameters);
+
+ add(new UsernamePasswordPanel("signInPanel"));
}
}
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_de.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_de.html
new file mode 100644
index 0000000000..e4e6fcacaf
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_de.html
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Anmelden</title>
+</head>
+<body>
+ <h2>Anmelden</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_fr.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_fr.html
new file mode 100644
index 0000000000..9068ffc1ed
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_fr.html
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Authentification</title>
+</head>
+<body>
+ <h2>Veuillez vous authentifier</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_hu.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_hu.html
new file mode 100644
index 0000000000..2d32334b8b
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_hu.html
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Bejelentkezés</title>
+</head>
+<body>
+ <h2>Bejelentkezés</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_pl.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_pl.html
new file mode 100644
index 0000000000..e20dbb3c31
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_pl.html
@@ -0,0 +1,12 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Zaloguj się</title>
+</head>
+<body>
+ <h2>Zaloguj się</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_ru.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_ru.html
new file mode 100644
index 0000000000..988a577da4
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/pages/UsernamePasswordPage_ru.html
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Вход</title>
+</head>
+<body>
+ <h2>Вход</h2>
+ <p>
+ <span wicket:id="signInPanel"/>
+ </p>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/SignInPanel.java
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/SignInPanel.java
index 8e106309c3..649422c813 100644
---
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/SignInPanel.java
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/SignInPanel.java
@@ -35,14 +35,40 @@ import org.apache.wicket.model.CompoundPropertyModel;
* passing the username and password submitted. The signIn() method should
authenticate the user's
* session.
*
- * @see IAuthenticationStrategy
- * @see org.apache.wicket.settings.SecuritySettings#getAuthenticationStrategy()
- * @see DefaultAuthenticationStrategy
+ * <p>
+ * <strong>This panel is deprecated for security reasons.</strong> Its
"remember me" support hands
+ * the username and the password to {@link IAuthenticationStrategy}, whose
default implementation
+ * {@link DefaultAuthenticationStrategy} writes them into a cookie, so the
password is stored on the
+ * client and replayed on every visit. That mechanism is deprecated with no
replacement, because
+ * whatever it persists is what signs the user in; see {@link
IAuthenticationStrategy} for why it
+ * cannot be made safe.
+ * </p>
+ * <p>
+ * Use {@link UsernamePasswordPanel} instead. It is this panel without the
"remember me" option and
+ * with the same API otherwise, so switching over is a change of type name. An
application that needs
+ * a persistent login has to implement one itself, with a random, revocable,
per-device token rather
+ * than with the password.
+ * </p>
+ * <p>
+ * Two properties of the "remember me" support here are worth knowing before
relying on it, and
+ * neither is going to be fixed: the remedy is to stop using this panel rather
than to harden
+ * something that is being removed. Passing {@code false} to {@link
#SignInPanel(String, boolean)}
+ * only hides the checkbox — the {@code rememberMe} property still
starts out {@code true}, an
+ * invisible form component is never updated from the request, and so the
credentials are persisted
+ * on every successful sign in regardless. And {@link #onConfigure()} consults
neither flag, so any
+ * instance of this panel signs a visitor in from an existing cookie. See
{@code SECURITY.md} for the
+ * scope this places the panel in.
+ * </p>
*
* @author Jonathan Locke
* @author Juergen Donnerstag
* @author Eelco Hillenius
+ * @deprecated use {@link UsernamePasswordPanel}, which is this panel without
the "remember me"
+ * option. Persisting credentials on the client cannot be made
safe, so this panel is
+ * removed in Wicket 11.
*/
+@Deprecated(since = "8.19.0, 9.24.0, 10.11.0", forRemoval = true)
+@SuppressWarnings("removal")
public class SignInPanel extends Panel
{
private static final long serialVersionUID = 1L;
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.html
new file mode 100644
index 0000000000..e65528a111
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Username:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Password:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit" value="Sign
In"/>
+ <input type="reset" value="Reset"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.java
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.java
new file mode 100644
index 0000000000..a17e898e13
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel.java
@@ -0,0 +1,193 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.wicket.authroles.authentication.panel;
+
+import org.apache.wicket.authroles.authentication.AuthenticatedWebSession;
+import org.apache.wicket.markup.html.form.PasswordTextField;
+import org.apache.wicket.markup.html.form.StatelessForm;
+import org.apache.wicket.markup.html.form.TextField;
+import org.apache.wicket.markup.html.panel.FeedbackPanel;
+import org.apache.wicket.markup.html.panel.Panel;
+import org.apache.wicket.model.CompoundPropertyModel;
+
+/**
+ * Reusable sign in panel with a username and a password field. When the
panel's form is submitted,
+ * the submitted values are passed to {@link
AuthenticatedWebSession#signIn(String, String)}, which
+ * authenticates the user's session.
+ * <p>
+ * The credentials live no longer than the session: nothing is written to the
client, so a user signs
+ * in again once the session has ended. Wicket offers no supported way to
persist credentials on the
+ * client and get an automatic sign in on a later visit — anything
stored there authenticates
+ * the user by itself, and the framework cannot make that safe. An application
that needs a
+ * persistent login has to implement one, and should do so with a random,
revocable, per-device token
+ * rather than with the password; {@link
AuthenticatedWebSession#signIn(boolean)} exists so that such
+ * a token can sign a session in without being passed to
+ * {@link AuthenticatedWebSession#authenticate(String, String)}.
+ *
+ * @author Jonathan Locke
+ * @author Juergen Donnerstag
+ * @author Eelco Hillenius
+ */
+public class UsernamePasswordPanel extends Panel
+{
+ private static final long serialVersionUID = 1L;
+
+ private static final String SIGN_IN_FORM = "signInForm";
+
+ /** password. */
+ private String password;
+
+ /** user name. */
+ private String username;
+
+ /**
+ * @see org.apache.wicket.Component#Component(String)
+ */
+ public UsernamePasswordPanel(final String id)
+ {
+ super(id);
+
+ // Create feedback panel and add to page
+ add(new FeedbackPanel("feedback"));
+
+ // Add sign-in form to page, passing feedback panel as
+ // validation error handler
+ add(new SignInForm(SIGN_IN_FORM));
+ }
+
+ /**
+ *
+ * @return signin form
+ */
+ protected SignInForm getForm()
+ {
+ return (SignInForm)get(SIGN_IN_FORM);
+ }
+
+ /**
+ * Convenience method to access the password.
+ *
+ * @return The password
+ */
+ public String getPassword()
+ {
+ return password;
+ }
+
+ /**
+ * Set the password
+ *
+ * @param password
+ */
+ public void setPassword(final String password)
+ {
+ this.password = password;
+ }
+
+ /**
+ * Convenience method to access the username.
+ *
+ * @return The user name
+ */
+ public String getUsername()
+ {
+ return username;
+ }
+
+ /**
+ * Set the username
+ *
+ * @param username
+ */
+ public void setUsername(final String username)
+ {
+ this.username = username;
+ }
+
+ /**
+ * Sign in user if possible.
+ *
+ * @param username
+ * The username
+ * @param password
+ * The password
+ * @return True if signin was successful
+ */
+ private boolean signIn(String username, String password)
+ {
+ return AuthenticatedWebSession.get().signIn(username, password);
+ }
+
+ /**
+ * Called when sign in failed
+ */
+ protected void onSignInFailed()
+ {
+ // Try the component based localizer first. If not found try the
+ // application localizer. Else use the default
+ error(getLocalizer().getString("signInFailed", this, "Sign in
failed"));
+ }
+
+ /**
+ * Called when sign in was successful
+ */
+ protected void onSignInSucceeded()
+ {
+ // If login has been called because the user was not yet logged
in, than continue to the
+ // original destination, otherwise to the Home page
+ continueToOriginalDestination();
+ setResponsePage(getApplication().getHomePage());
+ }
+
+ /**
+ * Sign in form.
+ */
+ public final class SignInForm extends
StatelessForm<UsernamePasswordPanel>
+ {
+ private static final long serialVersionUID = 1L;
+
+ /**
+ * Constructor.
+ *
+ * @param id
+ * id of the form component
+ */
+ public SignInForm(final String id)
+ {
+ super(id);
+
+ setModel(new
CompoundPropertyModel<>(UsernamePasswordPanel.this));
+
+ // Attach textfields for username and password
+ add(new TextField<>("username").setRequired(true));
+ add(new PasswordTextField("password"));
+ }
+
+ @Override
+ public void onSubmit()
+ {
+ if (signIn(getUsername(), getPassword()))
+ {
+ onSignInSucceeded();
+ }
+ else
+ {
+ onSignInFailed();
+ }
+ }
+ }
+}
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.html
new file mode 100644
index 0000000000..4e677ad936
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.html
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Wicket Examples - signin2</title>
+ <link rel="stylesheet" type="text/css" href="style.css"/>
+</head>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Benutzername:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Passwort:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Anmelden"/>
+ <input type="reset" value="Reset"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.properties
new file mode 100644
index 0000000000..7f775fdad8
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_de.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = Fehler bei der Anmeldung
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.html
new file mode 100644
index 0000000000..97b9cb0bcd
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Identifiant:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Mot de passe:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="S'identifier"/>
+ <input type="reset" value="Annuler"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.properties.xml
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.properties.xml
new file mode 100644
index 0000000000..502e02c835
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_fr.properties.xml
@@ -0,0 +1,21 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<!DOCTYPE properties SYSTEM "http://java.sun.com/dtd/properties.dtd";>
+<properties>
+ <entry key="signInFailed">Erreur d'authentification</entry>
+</properties>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.html
new file mode 100644
index 0000000000..c7c2244553
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Felhasználónév:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Jelszó:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Bejelentkezés"/>
+ <input type="reset" value="Alaphelyzet"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.properties
new file mode 100644
index 0000000000..b4abc6fad8
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_hu.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = Hiba a bejelentkez\u00E9s sor\u00E1n
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ja.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ja.html
new file mode 100644
index 0000000000..037bf77751
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ja.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>ユーザー名:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>パスワード:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="サインイン"/>
+ <input type="reset" value="リセット"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ko.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ko.html
new file mode 100644
index 0000000000..b4e8729c7d
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ko.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>사용자명:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>비밀번호:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit" value="로그인"/>
+ <input type="reset" value="취소"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.html
new file mode 100644
index 0000000000..c3fef8a2e3
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.html
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Wicket Examples - signin2</title>
+ <link rel="stylesheet" type="text/css" href="style.css"/>
+</head>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Gebruikersnaam:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Wachtwoord:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Aanmelden"/>
+ <input type="reset" value="Reset"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.properties
new file mode 100644
index 0000000000..4200873f21
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_nl.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = Inloggen mislukt
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.html
new file mode 100644
index 0000000000..5c54dc2139
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.html
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Wicket Examples - signin2</title>
+ <link rel="stylesheet" type="text/css" href="style.css"/>
+</head>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Użytkownik:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Hasło:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Wchodzę"/>
+ <input type="reset" value="Rezygnuję"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.properties
new file mode 100644
index 0000000000..3282a1589c
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_pl.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = Bl\u0105d podczas logowania
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.html
new file mode 100644
index 0000000000..abf835faa9
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.html
@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<body>
+<wicket:panel>
+ <span wicket:id="feedback" />
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>Логин:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>Пароль:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit"
value="Вход"/>
+ <input type="reset" value="Сброс"/>
+ </dd>
+ </dl>
+ </form>
+</wicket:panel>
+</body>
+</html>
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.properties
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.properties
new file mode 100644
index 0000000000..7cfd8df3e6
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_ru.properties
@@ -0,0 +1,15 @@
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+signInFailed = \u041d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c
\u0432\u043e\u0439\u0442\u0438
diff --git
a/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_zh_CN.html
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_zh_CN.html
new file mode 100644
index 0000000000..75acb5f023
--- /dev/null
+++
b/wicket-auth-roles/src/main/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanel_zh_CN.html
@@ -0,0 +1,41 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!--
+ Licensed to the Apache Software Foundation (ASF) under one or more
+ contributor license agreements. See the NOTICE file distributed with
+ this work for additional information regarding copyright ownership.
+ The ASF licenses this file to You under the Apache License, Version 2.0
+ (the "License"); you may not use this file except in compliance with
+ the License. You may obtain a copy of the License at
+
+ http://www.apache.org/licenses/LICENSE-2.0
+
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License.
+-->
+<html xmlns:wicket="http://wicket.apache.org";>
+<head>
+ <title>Wicket Examples - signin2</title>
+ <link rel="stylesheet" type="text/css" href="style.css"/>
+</head>
+<body>
+ <wicket:panel>
+ <span wicket:id="feedback"/>
+
+ <form wicket:id="signInForm">
+ <dl>
+ <dt>用户名:</dt>
+ <dd><input wicket:id="username" type="text"
size="30"/></dd>
+ <dt>密码:</dt>
+ <dd><input wicket:id="password" type="password"
size="30"/></dd>
+ <dd>
+ <input type="submit" name="submit" value="到"/>
+ <input type="reset" value="重新设置"/>
+ </dd>
+ </dl>
+ </form>
+ </wicket:panel>
+</body>
+</html>
\ No newline at end of file
diff --git
a/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
b/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
index e4208c5b7c..ba6953928c 100644
---
a/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
+++
b/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
@@ -36,6 +36,7 @@ import org.junit.jupiter.api.Test;
/**
* Tests for {@link SignInPanel}
*/
+@SuppressWarnings("removal") // the panel under test is deprecated for removal
public class SignInPanelTest
{
diff --git
a/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
b/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanelTest.java
similarity index 56%
copy from
wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
copy to
wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanelTest.java
index e4208c5b7c..5512c236b4 100644
---
a/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/SignInPanelTest.java
+++
b/wicket-auth-roles/src/test/java/org/apache/wicket/authroles/authentication/panel/UsernamePasswordPanelTest.java
@@ -17,11 +17,14 @@
package org.apache.wicket.authroles.authentication.panel;
import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.util.Locale;
import java.util.concurrent.atomic.AtomicInteger;
+import jakarta.servlet.http.Cookie;
+
import org.apache.wicket.MarkupContainer;
-import org.apache.wicket.Session;
import org.apache.wicket.authroles.authentication.AuthenticatedWebApplication;
import org.apache.wicket.authroles.authentication.AuthenticatedWebSession;
import org.apache.wicket.authroles.authorization.strategies.role.Roles;
@@ -30,14 +33,20 @@ import org.apache.wicket.markup.html.WebPage;
import org.apache.wicket.request.Request;
import org.apache.wicket.util.resource.IResourceStream;
import org.apache.wicket.util.resource.StringResourceStream;
+import org.apache.wicket.util.tester.FormTester;
import org.apache.wicket.util.tester.WicketTester;
import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.ValueSource;
/**
- * Tests for {@link SignInPanel}
+ * Tests for {@link UsernamePasswordPanel}
*/
-public class SignInPanelTest
+public class UsernamePasswordPanelTest
{
+ private static final String USERNAME = "user";
+
+ private static final String PASSWORD = "secret";
/**
* https://issues.apache.org/jira/browse/WICKET-3980
@@ -60,14 +69,67 @@ public class SignInPanelTest
assertEquals(1, constructorsCalls.get());
}
- private static class TestPage extends WebPage implements
IMarkupResourceStreamProvider
+ /**
+ * The panel ships localized markup; every variant has to resolve and
render, which is what
+ * catches a missing component or a stray {@code wicket:id} in one of
them.
+ *
+ * @param languageTag
+ * the locale to render in
+ */
+ @ParameterizedTest
+ @ValueSource(strings = { "de", "fr", "hu", "ja", "ko", "nl", "pl",
"ru", "zh-CN" })
+ public void rendersInEveryLocale(String languageTag)
+ {
+ WicketTester tester = new WicketTester(new TestApplication());
+
tester.getSession().setLocale(Locale.forLanguageTag(languageTag));
+
+ tester.startPage(new TestPage(new AtomicInteger(0)));
+
+ tester.assertRenderedPage(TestPage.class);
+ tester.assertComponent("signInPanel:signInForm:username",
+ org.apache.wicket.markup.html.form.TextField.class);
+ }
+
+ /**
+ * This panel keeps nothing on the client: a successful sign in must
leave no cookie behind, and
+ * in particular not the one the removed authentication strategy used.
+ */
+ @Test
+ public void signInPersistsNothingOnTheClient()
+ {
+ WicketTester tester = new WicketTester(new TestApplication());
+ tester.startPage(new TestPage(new AtomicInteger(0)));
+
+ FormTester form =
tester.newFormTester("signInPanel:signInForm");
+ form.setValue("username", USERNAME);
+ form.setValue("password", PASSWORD);
+ form.submit();
+
+ assertTrue(AuthenticatedWebSession.get().isSignedIn(), "should
be signed in");
+
assertTrue(tester.getLastResponse().getCookies().stream().map(Cookie::getName)
+ .noneMatch("LoggedIn"::equals), "no credentials may be
persisted on the client");
+ }
+
+ /**
+ * The page hosting the panel. It doubles as the home page, so it needs
a default constructor for
+ * the redirect after a successful sign in.
+ */
+ public static class TestPage extends WebPage implements
IMarkupResourceStreamProvider
{
+ /**
+ * Construct.
+ */
+ public TestPage()
+ {
+ this(new AtomicInteger(0));
+ }
+
private TestPage(AtomicInteger constructorCalls)
{
super();
constructorCalls.incrementAndGet();
- add(new SignInPanel("signInPanel"));
+ add(new UsernamePasswordPanel("signInPanel"));
}
@Override
@@ -80,7 +142,7 @@ public class SignInPanelTest
}
/**
- * A {@link Session session} for the test
+ * A {@link org.apache.wicket.Session session} for the test
*/
public static class TestSession extends AuthenticatedWebSession
{
@@ -104,7 +166,7 @@ public class SignInPanelTest
@Override
public boolean authenticate(String username, String password)
{
- return false;
+ return USERNAME.equals(username) &&
PASSWORD.equals(password);
}
}
diff --git
a/wicket-core/src/main/java/org/apache/wicket/authentication/IAuthenticationStrategy.java
b/wicket-core/src/main/java/org/apache/wicket/authentication/IAuthenticationStrategy.java
index c75a25c69a..f8e99c5997 100644
---
a/wicket-core/src/main/java/org/apache/wicket/authentication/IAuthenticationStrategy.java
+++
b/wicket-core/src/main/java/org/apache/wicket/authentication/IAuthenticationStrategy.java
@@ -22,9 +22,34 @@ import org.apache.wicket.Application;
* The interface of an authentication strategy which is accessible via
* {@link Application#getSecuritySettings()}. Implementations determine how
logon data (username and
* password) are persisted (e.g. Cookie), retrieved and removed.
+ * <p>
+ * <strong>This interface is deprecated for security reasons and cannot be
made safe.</strong>
+ * Whatever it persists is what signs the user in: {@link #load()} hands its
result straight to
+ * {@code AuthenticatedWebSession#signIn(String, String)}, so what is stored
on the client is the
+ * password, and it is replayed on every visit for as long as the cookie
lives. Wicket's own
+ * implementation joins the username and the password with a fixed separator
and writes them to a
+ * cookie that has a thirty day lifetime and no {@code Secure} attribute,
encrypted with
+ * {@code PBEWithMD5AndDES} — DES in an unauthenticated mode —
under a key that is
+ * regenerated on every restart. Anyone who obtains that cookie can sign in as
the user, and the
+ * fixed separator gives them a crib for recovering the password itself.
+ * </p>
+ * <p>
+ * None of that is a defect in the implementation. {@code
AuthenticatedWebSession} already says that
+ * a cookie based login "may not rely on putting username and password into
the cookie but something
+ * else that safely identifies the user", and this contract cannot express
that: {@link #load()}
+ * returns credentials for {@code authenticate(String, String)} to check, so a
token can only be
+ * carried here by making the application accept that token as a password.
There is therefore no
+ * replacement and no configuration that makes this safe. An application that
needs a persistent
+ * login has to implement one itself, with a random, revocable, per-device
token, and can sign the
+ * session in with {@code AuthenticatedWebSession#signIn(boolean)} once it has
verified that token
+ * for itself. See {@code SECURITY.md} for the scope this places the interface
in.
+ * </p>
*
* @author Juergen Donnerstag
+ * @deprecated no replacement; see above. Persisting credentials on the client
so that a later visit
+ * can replay them cannot be made safe, so this is removed in
Wicket 11.
*/
+@Deprecated(since = "8.19.0, 9.24.0, 10.11.0", forRemoval = true)
public interface IAuthenticationStrategy
{
/**
diff --git
a/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/DefaultAuthenticationStrategy.java
b/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/DefaultAuthenticationStrategy.java
index b905858f64..5c260a6c89 100644
---
a/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/DefaultAuthenticationStrategy.java
+++
b/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/DefaultAuthenticationStrategy.java
@@ -32,8 +32,20 @@ import org.slf4j.LoggerFactory;
* Note: To support automatic authentication across application restarts you
have to use
* the constructor {@link
DefaultAuthenticationStrategy#DefaultAuthenticationStrategy(String, ICrypt)}.
*
+ * <p>
+ * <strong>This class is deprecated for security reasons and cannot be made
safe.</strong> It joins
+ * the username and the password with {@code -sep-} and writes the result to a
cookie, so the
+ * password itself is stored on the client and replayed on every visit. See
+ * {@link IAuthenticationStrategy} for why there is no replacement, and {@code
SECURITY.md} for the
+ * scope this places the class in.
+ * </p>
+ *
* @author Juergen Donnerstag
+ * @deprecated no replacement; see {@link IAuthenticationStrategy}. Persisting
credentials on the
+ * client cannot be made safe, so this is removed in Wicket 11.
*/
+@Deprecated(since = "8.19.0, 9.24.0, 10.11.0", forRemoval = true)
+@SuppressWarnings("removal")
public class DefaultAuthenticationStrategy implements IAuthenticationStrategy
{
private static final Logger logger =
LoggerFactory.getLogger(DefaultAuthenticationStrategy.class);
diff --git
a/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/NoOpAuthenticationStrategy.java
b/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/NoOpAuthenticationStrategy.java
index 21460638cd..6ff99a50f9 100644
---
a/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/NoOpAuthenticationStrategy.java
+++
b/wicket-core/src/main/java/org/apache/wicket/authentication/strategy/NoOpAuthenticationStrategy.java
@@ -22,7 +22,11 @@ import
org.apache.wicket.authentication.IAuthenticationStrategy;
* A no-op implementation. No username or password will be persisted or
retrieved.
*
* @author Juergen Donnerstag
+ * @deprecated no replacement; this implementation goes with the deprecated
+ * {@link IAuthenticationStrategy} it implements, and is removed
in Wicket 11.
*/
+@Deprecated(since = "8.19.0, 9.24.0, 10.11.0", forRemoval = true)
+@SuppressWarnings("removal")
public class NoOpAuthenticationStrategy implements IAuthenticationStrategy
{
@Override
diff --git
a/wicket-core/src/main/java/org/apache/wicket/protocol/http/WebSession.java
b/wicket-core/src/main/java/org/apache/wicket/protocol/http/WebSession.java
index 3a303fbf86..c29f5eee43 100644
--- a/wicket-core/src/main/java/org/apache/wicket/protocol/http/WebSession.java
+++ b/wicket-core/src/main/java/org/apache/wicket/protocol/http/WebSession.java
@@ -58,6 +58,9 @@ public class WebSession extends Session
*
* @see org.apache.wicket.Session#invalidate()
*/
+ // the authentication strategy is deprecated for removal, but clearing
whatever it persisted is
+ // exactly what has to keep happening while it still exists
+ @SuppressWarnings("removal")
@Override
public void invalidate()
{
diff --git
a/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
b/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
index fdd9782538..cdbb40fc5c 100644
--- a/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
+++ b/wicket-core/src/main/java/org/apache/wicket/settings/SecuritySettings.java
@@ -53,6 +53,7 @@ public class SecuritySettings
private IAuthorizationStrategy authorizationStrategy =
IAuthorizationStrategy.ALLOW_ALL;
/** The authentication strategy. */
+ @SuppressWarnings("removal")
private IAuthenticationStrategy authenticationStrategy;
/** factory for creating crypt objects */
@@ -269,8 +270,11 @@ public class SecuritySettings
* Gets the authentication strategy.
*
* @return Returns the authentication strategy.
+ * @deprecated no replacement; see {@link IAuthenticationStrategy}.
Persisting credentials on the
+ * client cannot be made safe, so this is removed in Wicket
11.
*/
- @SuppressWarnings("deprecation")
+ @Deprecated(since = "8.19.0, 9.24.0, 10.11.0", forRemoval = true)
+ @SuppressWarnings("removal")
public IAuthenticationStrategy getAuthenticationStrategy()
{
if (authenticationStrategy == null)
@@ -286,7 +290,11 @@ public class SecuritySettings
* @param strategy
* new authentication strategy
* @return {@code this} object for chaining
+ * @deprecated no replacement; see {@link IAuthenticationStrategy}.
Persisting credentials on the
+ * client cannot be made safe, so this is removed in Wicket
11.
*/
+ @Deprecated(since = "8.19.0, 9.24.0, 10.11.0", forRemoval = true)
+ @SuppressWarnings("removal")
public SecuritySettings setAuthenticationStrategy(final
IAuthenticationStrategy strategy)
{
authenticationStrategy = strategy;
