[
https://issues.apache.org/jira/browse/WICKET-7193?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106590#comment-18106590
]
ASF subversion and git services commented on WICKET-7193:
---------------------------------------------------------
Commit 7c955be615655e7fd930d3c589d58c14b940e835 in wicket's branch
refs/heads/wicket-10.x from Emond Papegaaij
[ https://gitbox.apache.org/repos/asf?p=wicket.git;h=7c955be615 ]
WICKET-7193 Deprecate the authentication strategy and the remember-me panel
IAuthenticationStrategy exists to persist sign-in credentials so that a later
visit signs the user in automatically. Its contract is credential-shaped and
cannot be anything else: load() hands its result straight to
AuthenticatedWebSession.signIn(String, String), so what is stored on the client
is the password, replayed on every visit for as long as the cookie lives.
DefaultAuthenticationStrategy, the only real implementation, joins the username
and the password with "-sep-" and writes them to a cookie named LoggedIn. That
cookie is HttpOnly and SameSite=Lax, but it has no Secure attribute and a thirty
day lifetime, and it is encrypted with PBEWithMD5AndDES -- DES in an
unauthenticated mode -- under a key regenerated on every restart. Anyone who
obtains it can sign in as the user, and the fixed separator is a crib for
recovering the password itself.
None of that is a defect in the implementation. AuthenticatedWebSession already
documents that a cookie based login "may not rely on putting username and
password into the cookie but something else that safely identifies the user",
and this contract cannot express that: load() returns credentials for
authenticate(String, String) to check, so a token could only be carried by
making
the application accept that token as a password. There is no replacement and no
configuration that makes it safe, which is the second case SECURITY.md describes
-- the design rather than the implementation is the problem, so it is deprecated
with no replacement offered.
Deprecating the strategy alone would not be enough. SECURITY.md is explicit that
deprecating a member does not deprecate the behaviour behind it where the
feature
is still reachable without the application opting in, and an application that
writes new SignInPanel("signInPanel") -- as SignInPage does -- gets credential
persistence without naming a single deprecated member. Rather than change a
default on a supported release line, SignInPanel and SignInPage are deprecated
as
well, and UsernamePasswordPanel and UsernamePasswordPage are added in their
place: naming a deprecated class is something an application does deliberately,
which is what SECURITY.md excludes.
The new types are copies with the remember-me support removed and everything
else
kept, including the package, the member names, the "signInForm" component id,
the
signInFailed resource key and all nine localizations, so migrating is a change
of
type name. Nothing else changes: this commit adds annotations, javadoc and two
new
types; no default is flipped and no behaviour moves.
Two properties of SignInPanel's remember-me support are named in its javadoc and
deliberately left as they are, because the remedy is to stop using the panel
rather than to harden something that is being removed. Passing false to
SignInPanel(String, boolean) only hides the checkbox -- rememberMe still starts
out true and an invisible form component is never updated from the request, so
the credentials are persisted on every successful sign in regardless. And
onConfigure() consults neither flag, so any instance of the panel signs a
visitor
in from an existing cookie.
The removal happens in Wicket 11.
Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>
> Deprecate and remove IAuthenticationStrategy
> --------------------------------------------
>
> Key: WICKET-7193
> URL: https://issues.apache.org/jira/browse/WICKET-7193
> Project: Wicket
> Issue Type: Task
> Affects Versions: 11.0.0, 9.23.0, 8.18.0, 10.10.0
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
>
> The interface IAuthenticationStrategy allows saving and loading credentials
> in a cookie. The only implementation DefaultAuthenticationStrategy does
> exactly this. Storing credentials in a cookie (encrypted or not) is a
> questionable practice and there is very little reason for wicket to support
> this out of the box. We should deprecate this interface in all supported
> wicket versions, stating that is retired for security reasons with no
> replacement. In 11 we can remove the interface and implementation and remove
> the 'Remember me' checkbox in SignInPanel in wicket-auth-roles.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
