← Index · ← File index · ← Prev · Next → · 📄 source

#1136: CookieService.kt

projectforge-business/src/main/kotlin/org/projectforge/business/user/filter/CookieService.kt Service, projectforge-business/src/main/kotlin/org/projectforge/business/user/filter/CookieService.kt 205 lines · 150 code · 36 comments · 19 blank
Service for handling HTTP cookies in the authentication filter chain, managing session and remember-me cookie creation, validation, and deletion.

Architecture

Cookie Lifecycle

Manages creation of signed cookies containing user identifier, series token, and serial number. Validates cookies against stored tokens on each request, regenerates on changes, and handles deletion on logout or token invalidation.

Security Design

Uses persistent-token pattern: each series has a rotating random token. When an old token is presented (cookie theft detected), the entire series is invalidated, protecting the legitimate user's session.

Design Rationale

Extracted from the filter chain to allow cookie operations to be tested independently. The service layer separation enables different implementations for Wicket and REST endpoints.

Architecture Analysis

Resides in projectforge-business, the core module containing domain logic, services, and persistence. Acts as a Query Filter in the custom result filtering infrastructure, used by search and list pages to narrow down database results based on user-selected criteria. Typically annotated with @Service or @Component, managed by the Spring IoC container with dependency injection.

Git History

CommitWhat changed
868d6abb752025 -> 2026
63081666f6Source file headers: 2024-> 2025.
4c04cfd652MAJOR-CHANGE! Migration of integer id's to Long id's (including fk's etc.)
77bade6dfbjavax.* -> jakarta.*
b6092df092Copyright 2023 -> 2024
ab45d51fa4Copyright 2001-2022 -> 2001-2023.
ea7ec2556fRefactored (due to security reasons): PFUserDO.password -> UserPasswordDO.passwordHash
9559cc9f99CookieService: Update user's last login timestamp on using stay-logged-in-cookie.
73792cf5f8Delete stay-logged-in-cookie on failure.
ca914dbb97WIP: 2FA after login (required for users with Authenticator App configured.
81476bb1eeUserFilter -> Kotlin
5f7ef41b8cCopyright 2021 -> 2022
c49de356f7WIP: 2FA. Clear all cookies of CookieService on logout.
8641d51bc5CookieService: refactored (format of stayLoggedInCookie changed, old format is supported). WIP: 2FA
6662d268d2CookieService -> Kotlin