Java EE 8 及更高版本
如果您使用的是 Java EE 8 或更高版本，请@RememberMe使用自定义HttpAuthenticationMechanism和RememberMeIdentityStore.
@ApplicationScoped
@AutoApplySession
@RememberMe
public class CustomAuthenticationMechanism implements HttpAuthenticationMechanism {
@Inject
private IdentityStore identityStore;
@Override
public AuthenticationStatus validateRequest(HttpServletRequest request, HttpServletResponse response, HttpMessageContext context) {
Credential credential = context.getAuthParameters().getCredential();
if (credential != null) {
return context.notifyContainerAboutLogin(identityStore.validate(credential));
}
else {
return context.doNothing();
}
}
}
public class CustomIdentityStore implements RememberMeIdentityStore {
@Inject
private UserService userService; // This is your own EJB.
@Inject
private LoginTokenService loginTokenService; // This is your own EJB.
@Override
public CredentialValidationResult validate(RememberMeCredential credential) {
Optional<User> user = userService.findByLoginToken(credential.getToken());
if (user.isPresent()) {
return new CredentialValidationResult(new CallerPrincipal(user.getEmail()));
}
else {
return CredentialValidationResult.INVALID_RESULT;
}
}
@Override
public String generateLoginToken(CallerPrincipal callerPrincipal, Set<String> groups) {
return loginTokenService.generateLoginToken(callerPrincipal.getName());
}
@Override
public void removeLoginToken(String token) {
loginTokenService.removeLoginToken(token);
}
}
您可以在Java EE Kickoff Application中找到一个真实的示例。
Java EE 6/7
如果您使用的是 Java EE 6 或 7，则自制一个长期存在的 cookie 来跟踪唯一客户端，并HttpServletRequest#login()在用户未登录但 cookie 存在时使用 Servlet 3.0 API 提供的编程登录。
java.util.UUID如果您创建另一个数据库表，其值为 PK，相关用户的 ID 为 FK，这是最容易实现的。
假设以下登录表单：
<form action="login" method="post">
<input type="text" name="username" />
<input type="password" name="password" />
<input type="checkbox" name="remember" value="true" />
<input type="submit" />
</form>
以及映射到doPost()的 a 方法中的以下内容：Servlet/login
String username = request.getParameter("username");
String password = hash(request.getParameter("password"));
boolean remember = "true".equals(request.getParameter("remember"));
User user = userService.find(username, password);
if (user != null) {
request.login(user.getUsername(), user.getPassword()); // Password should already be the hashed variant.
request.getSession().setAttribute("user", user);
if (remember) {
String uuid = UUID.randomUUID().toString();
rememberMeService.save(uuid, user);
addCookie(response, COOKIE_NAME, uuid, COOKIE_AGE);
} else {
rememberMeService.delete(user);
removeCookie(response, COOKIE_NAME);
}
}
（COOKIE_NAME应该是唯一的 cookie 名称，例如"remember"，COOKIE_AGE应该是以秒为单位的年龄，例如259200030 天）
以下是在受限页面上映射doFilter()的 a Filterwhich 的方法可能如下所示：
HttpServletRequest request = (HttpServletRequest) req;
HttpServletResponse response = (HttpServletResponse) res;
User user = request.getSession().getAttribute("user");
if (user == null) {
String uuid = getCookieValue(request, COOKIE_NAME);
if (uuid != null) {
user = rememberMeService.find(uuid);
if (user != null) {
request.login(user.getUsername(), user.getPassword());
request.getSession().setAttribute("user", user); // Login.
addCookie(response, COOKIE_NAME, uuid, COOKIE_AGE); // Extends age.
} else {
removeCookie(response, COOKIE_NAME);
}
}
}
if (user == null) {
response.sendRedirect("login");
} else {
chain.doFilter(req, res);
}
结合那些 cookie 辅助方法（太糟糕了，它们在 Servlet API 中丢失了）：
public static String getCookieValue(HttpServletRequest request, String name) {
Cookie[] cookies = request.getCookies();
if (cookies != null) {
for (Cookie cookie : cookies) {
if (name.equals(cookie.getName())) {
return cookie.getValue();
}
}
}
return null;
}
public static void addCookie(HttpServletResponse response, String name, String value, int maxAge) {
Cookie cookie = new Cookie(name, value);
cookie.setPath("/");
cookie.setMaxAge(maxAge);
response.addCookie(cookie);
}
public static void removeCookie(HttpServletResponse response, String name) {
addCookie(response, name, null, 0);
}
尽管UUID暴力破解非常困难，但您可以为用户提供一个选项，将“记住”选项锁定到用户的 IP 地址 ( request.getRemoteAddr()) 并将其存储/比较在数据库中。这使它更加健壮。此外，将“到期日期”存储在数据库中会很有用。
UUID每当用户更改其密码时，替换该值也是一个好习惯。
Java EE 5 或更低版本
请升级。