security: using standard NullRememberMeServices for API configuration

1 files changed, 9 insertions, 3 deletions

diff --git a/src/main/java/com/juick/service/security/HashParamAuthenticationFilter.java b/src/main/java/com/juick/service/security/HashParamAuthenticationFilter.java
index 5715038e..3dc58782 100644
--- a/src/main/java/com/juick/service/security/HashParamAuthenticationFilter.java
+++ b/src/main/java/com/juick/service/security/HashParamAuthenticationFilter.java
@@ -1,5 +1,5 @@
 /*
- * Copyright (C) 2008-2019, Juick
+ * Copyright (C) 2008-2020, Juick
  *
  * This program is free software: you can redistribute it and/or modify
  * it under the terms of the GNU Affero General Public License as
@@ -23,8 +23,10 @@ import com.juick.service.security.entities.JuickUser;
 import org.apache.commons.lang3.StringUtils;
 import org.springframework.security.authentication.AnonymousAuthenticationToken;
 import org.springframework.security.authentication.RememberMeAuthenticationToken;
+import org.springframework.security.authentication.UsernamePasswordAuthenticationToken;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
+import org.springframework.security.web.authentication.NullRememberMeServices;
 import org.springframework.security.web.authentication.RememberMeServices;
 import org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices;
 import org.springframework.util.Assert;
@@ -73,8 +75,12 @@ public class HashParamAuthenticationFilter extends OncePerRequestFilter {
             if (!user.isAnonymous()) {
                 User userWithPassword = userService.getUserByName(user.getName());
                 userWithPassword.setAuthHash(userService.getHashByUID(userWithPassword.getUid()));
-                Authentication authentication = new RememberMeAuthenticationToken(
-                        ((AbstractRememberMeServices)rememberMeServices).getKey(), new JuickUser(userWithPassword), JuickUser.USER_AUTHORITY);
+                Authentication authentication = rememberMeServices instanceof NullRememberMeServices
+                        ? new UsernamePasswordAuthenticationToken(userWithPassword.getName(),
+                        userWithPassword.getCredentials())
+                        :  new RememberMeAuthenticationToken(
+                        ((AbstractRememberMeServices)rememberMeServices).getKey(),
+                        new JuickUser(userWithPassword), JuickUser.USER_AUTHORITY);
 
                 SecurityContextHolder.getContext().setAuthentication(authentication);