Package org.apache.wiki.auth.login

# Class CookieAuthenticationLoginModule

java.lang.Object
org.apache.wiki.auth.login.AbstractLoginModule
org.apache.wiki.auth.login.CookieAuthenticationLoginModule

All Implemented Interfaces:
  `LoginModule`

public class CookieAuthenticationLoginModule extends AbstractLoginModule
Logs in a user based on a cookie stored in the user's computer. The cookie information is stored in the `jspwiki.workDir`, under the directory "logincookies". For security purposes it is a very, very good idea to prevent access to this directory by everyone except the web server process; otherwise people having read access to this directory may be able to spoof other users.

The cookie directory is scrubbed of old entries at regular intervals.

This module must be used with a CallbackHandler (such as `WebContainerCallbackHandler`) that supports the following Callback types:

1. `HttpRequestCallback`- supplies the cookie, which should contain an unique id for fetching the UID.
2. `WikiEngineCallback` - allows access to the Engine itself.

After authentication, a generic WikiPrincipal based on the username will be created and associated with the Subject.

Since:
  2.5.62
See Also:
  - `LoginModule.commit()`
  - `CookieAssertionLoginModule`

## Field Summary

Fields
Modifier and Type
Field
Description
`protected static final String`
`COOKIE_DIR`
The directory name under which the cookies are stored.
`static final String`
`PROP_LOGIN_EXPIRY_DAYS`
User property for setting how long the cookie is stored on the user's computer.

### Fields inherited from class org.apache.wiki.auth.login.AbstractLoginModule

`m_handler, m_options, m_principals, m_state, m_subject, NULL`

## Constructor Summary

Constructors
Constructor
Description
`CookieAuthenticationLoginModule()`

## Method Summary

Modifier and Type
Method
Description
`static void`
`clearLoginCookie(org.apache.wiki.api.core.Engine engine, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)`
Clears away the login cookie, and removes the uid-username mapping file as well.
`boolean`
`login()`
Logs in the user by calling back to the registered CallbackHandler with a series of callbacks.
`static void`
`setLoginCookie(org.apache.wiki.api.core.Engine engine, jakarta.servlet.http.HttpServletResponse response, String username)`
Sets a login cookie based on properties set by the user.

### Methods inherited from class org.apache.wiki.auth.login.AbstractLoginModule

`abort, commit, initialize, logout`

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### COOKIE_DIR

protected static final String COOKIE_DIR
The directory name under which the cookies are stored. The value is "logincookies".

See Also:
  - Constant Field Values

### PROP_LOGIN_EXPIRY_DAYS

public static final String PROP_LOGIN_EXPIRY_DAYS
User property for setting how long the cookie is stored on the user's computer. The value is "jspwiki.cookieAuthentication.expiry". The default expiry time is 14 days.

See Also:
  - Constant Field Values

## Constructor Details

### CookieAuthenticationLoginModule

public CookieAuthenticationLoginModule()

## Method Details

### login

public boolean login() throws LoginException
Logs in the user by calling back to the registered CallbackHandler with a series of callbacks. If the login succeeds, this method returns `true`

Specified by:
  `login` in interface `LoginModule`
Specified by:
  `login` in class `AbstractLoginModule`
Returns:
  `true` if the commit succeeded, or `false` if this LoginModule should be ignored.
Throws:
  `LoginException` - if the authentication fails
See Also:
  - `LoginModule.login()`

### setLoginCookie

public static void setLoginCookie(org.apache.wiki.api.core.Engine engine, jakarta.servlet.http.HttpServletResponse response, String username)
Sets a login cookie based on properties set by the user. This method also creates the cookie uid-username mapping in the work directory.

Parameters:
  `engine` - The Engine
  `response` - The HttpServletResponse
  `username` - The username for whom to create the cookie.

### clearLoginCookie

public static void clearLoginCookie(org.apache.wiki.api.core.Engine engine, jakarta.servlet.http.HttpServletRequest request, jakarta.servlet.http.HttpServletResponse response)
Clears away the login cookie, and removes the uid-username mapping file as well.

Parameters:
  `engine` - Engine
  `request` - Servlet request
  `response` - Servlet response