Class StoreBackedRememberMeService

java.lang.Object
com.svenruppert.jsentinel.authentication.StoreBackedRememberMeService
@ExperimentalJSentinelApi public final class StoreBackedRememberMeService extends Object
"Remember me" / persistent-login service built on top of a RememberMeTokenStore and a PasswordHasher.

The plain token is generated server-side at issue(SubjectId, Duration) time, returned to the caller exactly once (intended to ship in an HttpOnly; Secure cookie or equivalent), and immediately dropped — only the hash reaches the store. validate(String) hashes the candidate the same way and queries the store by hash; an attacker who exfiltrates the store cannot impersonate the subject without the cookie value.

Bound to one TenantId at construction. Multi-tenant deployments instantiate one service per tenant.

Token entropy: 256 bits from a SecureRandom, encoded as URL-safe base64 (no padding). Override via the tokenSource constructor argument if a different format is required by the carrier (cookie, header, query parameter).

  • Field Details

    • DEFAULT_TOKEN_BYTES

      public static final int DEFAULT_TOKEN_BYTES
      Default token entropy in bytes (256 bits).
      See Also:

  • Constructor Details

    • StoreBackedRememberMeService

      public StoreBackedRememberMeService(RememberMeTokenStore store, PasswordHasher hasher)
      Convenience constructor: binds to TenantId.DEFAULT, uses a system Clock and the default 256-bit token source.
      Parameters:
      store - backing token store; non-null
      hasher - password hasher used to hash tokens before persisting them; non-null

    • StoreBackedRememberMeService

      public StoreBackedRememberMeService(RememberMeTokenStore store, PasswordHasher hasher, TenantId tenant, Clock clock, Supplier<String> tokenSource)
      Full constructor.
      Parameters:
      store - backing token store; non-null
      hasher - password hasher used to hash tokens before persisting them; non-null
      tenant - tenant scope; null becomes TenantId.DEFAULT
      clock - time source; non-null
      tokenSource - supplier producing the plain token strings issued to clients; non-null and must return non-blank values

  • Method Details

    • issue

      public StoreBackedRememberMeService.IssuedToken issue(SubjectId subjectId, Duration ttl)
      Issues a new token for subjectId with the given TTL. The plain token is returned exactly once — callers ship it to the client (cookie / header) and discard it.
      Parameters:
      subjectId - subject the token authenticates; non-null
      ttl - lifetime; must be strictly positive
      Returns:
      issued token (plain value + record metadata)

    • validate

      public Optional<RememberMeTokenRecord> validate(String plainToken)
      Validates the supplied plain token. Returns the matching record only when the hash is known, the record is in the configured tenant, and the token has not expired. Expired matches are removed from the store as a side effect.
      Parameters:
      plainToken - plain token from the carrier; null/blank yields Optional.empty()
      Returns:
      matching record, if valid

    • revoke

      public boolean revoke(String plainToken)
      Revokes the supplied plain token. Idempotent — unknown tokens return false rather than throwing.
      Parameters:
      plainToken - plain token; null/blank returns false
      Returns:
      true when a record was removed

    • revokeAll

      public int revokeAll(SubjectId subjectId)
      Revokes every token issued to subjectId in this service's tenant.
      Parameters:
      subjectId - subject; non-null
      Returns:
      number of tokens removed

    • purgeExpired

      public int purgeExpired()
      Purges every expired token in the backing store. Spans all tenants — call once globally rather than per-tenant.
      Returns:
      number of tokens purged