[
https://issues.apache.org/jira/browse/WICKET-7193?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106589#comment-18106589
]
ASF subversion and git services commented on WICKET-7193:
---------------------------------------------------------
Commit a68214425a95a62df44c7b971a1226a173971ba0 in wicket's branch
refs/heads/master from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=a68214425a ]
WICKET-7193 Remove the authentication strategy and the remember-me panel
IAuthenticationStrategy existed to persist sign-in credentials so that a later
visit signed the user in automatically. Its contract was credential-shaped and
could not be anything else: load() handed its result straight to
AuthenticatedWebSession.signIn(String, String), so what was stored on the client
was the password, replayed on every visit for as long as the cookie lived.
DefaultAuthenticationStrategy, the only real implementation, joined the username
and the password with "-sep-" and wrote them to a cookie named LoggedIn with a
thirty day lifetime and no Secure attribute. AuthenticatedWebSession already
documents that a cookie based login "may not rely on putting username and
password into the cookie but something else that safely identifies the user",
and
the contract could not express that: load() returned credentials for
authenticate(String, String) to check, so a token could only be carried by
making
the application accept that token as a password. That is the design rather than
the implementation, so there is no replacement. An application that needs a
persistent login has to implement one, with a random, revocable, per-device
token.
Removed: the interface, DefaultAuthenticationStrategy and
NoOpAuthenticationStrategy -- both packages go with them, along with their JPMS
and OSGi exports -- and SecuritySettings#getAuthenticationStrategy() and
#setAuthenticationStrategy(). WebSession's invalidate() override existed only to
call remove() on the strategy, since Session.invalidate() just sets a metadata
flag, so it goes too. Nothing in Wicket 11 clears a LoggedIn cookie left behind
by
a Wicket 10 deployment; those expire on their own within thirty days.
The remember-me support went with it, so SignInPanel and SignInPage in
wicket-auth-roles are replaced by UsernamePasswordPanel and
UsernamePasswordPage.
The new types keep everything else, including the package, the member names, the
"signInForm" component id, the signInFailed resource key and all nine
localizations, so migrating is a change of type name; getRememberMe(),
setRememberMe(), onSignInRemembered() and the two-argument SignInPanel
constructor have no equivalent. UsernamePasswordPage additionally passes its
PageParameters to super, which SignInPage never did. SignInPanelTest becomes
UsernamePasswordPanelTest and gains two checks: that the panel renders in each
of
its nine localizations, and that a successful sign in leaves no cookie behind.
wicket.yml records the removal and rewrites both types. The user guide no longer
recommends SignInPanel for login forms, and the three places that named the
"remember me" cookie among the things Wicket encrypts no longer do. The comment
in
WicketExampleApplication warning that NoCrypt leaves passwords in cookies was
already stale -- since the crypt unification the strategy did not go through
getCryptFactory() -- and now says what NoCrypt actually affects.
All of the removed API is deprecated in 8.19.0, 9.24.0 and 10.11.0.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
> Deprecate and remove IAuthenticationStrategy
> --------------------------------------------
>
> Key: WICKET-7193
> URL: https://issues.apache.org/jira/browse/WICKET-7193
> Project: Wicket
> Issue Type: Task
> Affects Versions: 11.0.0, 9.23.0, 8.18.0, 10.10.0
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
>
> The interface IAuthenticationStrategy allows saving and loading credentials
> in a cookie. The only implementation DefaultAuthenticationStrategy does
> exactly this. Storing credentials in a cookie (encrypted or not) is a
> questionable practice and there is very little reason for wicket to support
> this out of the box. We should deprecate this interface in all supported
> wicket versions, stating that is retired for security reasons with no
> replacement. In 11 we can remove the interface and implementation and remove
> the 'Remember me' checkbox in SignInPanel in wicket-auth-roles.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
