From f84c1e7eac95ee3187885ddea80a4ff2085c0689 Mon Sep 17 00:00:00 2001 From: Vitaly Takmazov Date: Thu, 14 Dec 2017 16:09:27 +0300 Subject: spring-security: remember-me token was not generated properly in hash filter --- .../java/com/juick/service/security/HashParamAuthenticationFilter.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) (limited to 'juick-server-web/src/main/java/com') diff --git a/juick-server-web/src/main/java/com/juick/service/security/HashParamAuthenticationFilter.java b/juick-server-web/src/main/java/com/juick/service/security/HashParamAuthenticationFilter.java index ed24fc00..e8ea0492 100644 --- a/juick-server-web/src/main/java/com/juick/service/security/HashParamAuthenticationFilter.java +++ b/juick-server-web/src/main/java/com/juick/service/security/HashParamAuthenticationFilter.java @@ -69,8 +69,9 @@ public class HashParamAuthenticationFilter extends OncePerRequestFilter { User user = userService.getUserByHash(hash); if (!user.isAnonymous()) { + User userWithPassword = userService.getFullyUserByName(user.getName()); Authentication authentication = new RememberMeAuthenticationToken( - ((AbstractRememberMeServices)rememberMeServices).getKey(), new JuickUser(user), JuickUser.USER_AUTHORITY); + ((AbstractRememberMeServices)rememberMeServices).getKey(), new JuickUser(userWithPassword), JuickUser.USER_AUTHORITY); SecurityContextHolder.getContext().setAuthentication(authentication); -- cgit v1.2.3