enh(web): rememberMe cookie expiration is checked on the server

Author: lprimak

core/src/main/java/org/apache/shiro/mgt/AbstractRememberMeManager.java

@@ -25,17 +25,25 @@
 import org.apache.shiro.crypto.cipher.AesCipherService;
 import org.apache.shiro.crypto.cipher.ByteSourceBroker;
 import org.apache.shiro.crypto.cipher.CipherService;
+import org.apache.shiro.lang.io.ClassResolvingObjectInputStream;
 import org.apache.shiro.lang.io.DefaultSerializer;
 import org.apache.shiro.lang.io.Serializer;
 import org.apache.shiro.lang.util.ByteSource;
 import org.apache.shiro.lang.util.ByteUtils;
-import org.apache.shiro.lang.util.ClassUtils;
+import org.apache.shiro.lang.util.ClassUtils.ClassLoaderAccessor;
+import org.apache.shiro.lang.util.ClassUtils.ExceptionIgnoringAccessor;
 import org.apache.shiro.subject.PrincipalCollection;
 import org.apache.shiro.subject.Subject;
 import org.apache.shiro.subject.SubjectContext;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.ObjectInputStream;
+import java.io.Serial;
+import java.io.Serializable;
+import java.time.Instant;
 import java.util.function.Supplier;
 
 /**
@@ -66,16 +74,32 @@
  * @since 0.9
  */
 public abstract class AbstractRememberMeManager implements RememberMeManager {
+    protected record RememberedIdentity(PrincipalCollection principals, Instant creationTime) implements Serializable {
+        @Serial
+        private static final long serialVersionUID = 1L;
+    }
 
     /**
      * private inner log instance.
      */
     private static final Logger LOGGER = LoggerFactory.getLogger(AbstractRememberMeManager.class);
 
+    private static final ClassLoaderAccessor ADDITIONAL_CL_ACCESSOR = new ExceptionIgnoringAccessor() {
+        @Override
+        protected ClassLoader doGetClassLoader() {
+            return AbstractRememberMeManager.class.getClassLoader();
+        }
+    };
+
     /**
      * Serializer to use for converting PrincipalCollection instances to/from byte arrays
      */
-    private Serializer<PrincipalCollection> serializer = new DefaultSerializer<>();
+    private Serializer<RememberedIdentity> serializer = new DefaultSerializer<>() {
+        @Override
+        protected ObjectInputStream createObjectInputStream(InputStream inputStream) throws IOException {
+            return new ClassResolvingObjectInputStream(inputStream, ADDITIONAL_CL_ACCESSOR);
+        }
+    };
 
     /**
      * Cipher to use for encrypting/decrypting serialized byte arrays for added security
@@ -121,7 +145,7 @@ public AbstractRememberMeManager(Supplier<byte[]> keySupplier) {
      * @return the {@code Serializer} used to serialize and deserialize {@link PrincipalCollection} instances for
      * persistent remember me storage.
      */
-    public Serializer<PrincipalCollection> getSerializer() {
+    public Serializer<RememberedIdentity> getSerializer() {
         return serializer;
     }
 
@@ -134,7 +158,7 @@ public Serializer<PrincipalCollection> getSerializer() {
      * @param serializer the {@code Serializer} used to serialize and deserialize {@link PrincipalCollection} instances
      *                   for persistent remember me storage.
      */
-    public void setSerializer(Serializer<PrincipalCollection> serializer) {
+    public void setSerializer(Serializer<RememberedIdentity> serializer) {
         this.serializer = serializer;
     }
 
@@ -352,14 +376,14 @@ protected void rememberIdentity(Subject subject, PrincipalCollection accountPrin
     /**
      * Converts the given principal collection the byte array that will be persisted to be 'remembered' later.
      * <p/>
-     * This implementation first {@link #serialize(org.apache.shiro.subject.PrincipalCollection) serializes} the
+     * This implementation first {@link #serialize(RememberedIdentity) serializes} the
      * principals to a byte array and then {@link #encrypt(byte[]) encrypts} that byte array.
      *
      * @param principals the {@code PrincipalCollection} to convert to a byte array
      * @return the representative byte array to be persisted for remember me functionality.
      */
     protected byte[] convertPrincipalsToBytes(PrincipalCollection principals) {
-        byte[] bytes = serialize(principals);
+        byte[] bytes = serialize(new RememberedIdentity(principals, now()));
         if (getCipherService() != null) {
             bytes = encrypt(bytes);
         }
@@ -433,7 +457,28 @@ protected PrincipalCollection convertBytesToPrincipals(byte[] bytes, SubjectCont
         if (getCipherService() != null) {
             bytes = decrypt(bytes);
         }
-        return deserialize(bytes);
+        RememberedIdentity remembered = deserialize(bytes);
+        return checkExpiration(remembered);
+    }
+
+    /**
+     * Checks the given remembered identity for expiration.  The default implementation does not perform any expiration
+     * checks and simply returns the principals.  Subclasses can override this method to perform expiration checks based on the
+     * {@code creationTime} property of the {@code RememberedIdentity}
+     * @param remembered identity
+     * @return PrincipalCollection
+     */
+    protected PrincipalCollection checkExpiration(RememberedIdentity remembered) {
+        return remembered.principals();
+    }
+
+    /**
+     * Returns the current time as an {@link Instant}.  Subclasses can override this method to provide a different time,
+     * such as for testing
+     * @return the current time as an {@link Instant}
+     */
+    protected Instant now() {
+        return Instant.now();
     }
 
     /**
@@ -508,13 +553,8 @@ protected byte[] decrypt(byte[] encrypted) {
      * @param principals the principal collection to serialize to a byte array
      * @return the serialized principal collection in the form of a byte array
      */
-    protected byte[] serialize(PrincipalCollection principals) {
-        ClassUtils.setAdditionalClassLoader(AbstractRememberMeManager.class.getClassLoader());
-        try {
-            return getSerializer().serialize(principals);
-        } finally {
-            ClassUtils.removeAdditionalClassLoader();
-        }
+    protected byte[] serialize(RememberedIdentity principals) {
+        return getSerializer().serialize(principals);
     }
 
     /**
@@ -524,13 +564,8 @@ protected byte[] serialize(PrincipalCollection principals) {
      * @param serializedIdentity the previously serialized {@code PrincipalCollection} as a byte array
      * @return the deserialized (reconstituted) {@code PrincipalCollection}
      */
-    protected PrincipalCollection deserialize(byte[] serializedIdentity) {
-        ClassUtils.setAdditionalClassLoader(AbstractRememberMeManager.class.getClassLoader());
-        try {
-            return getSerializer().deserialize(serializedIdentity);
-        } finally {
-            ClassUtils.removeAdditionalClassLoader();
-        }
+    protected RememberedIdentity deserialize(byte[] serializedIdentity) {
+        return getSerializer().deserialize(serializedIdentity);
     }
 
     /**

lang/src/main/java/org/apache/shiro/lang/io/ClassResolvingObjectInputStream.java

@@ -19,6 +19,7 @@
 package org.apache.shiro.lang.io;
 
 import org.apache.shiro.lang.util.ClassUtils;
+import org.apache.shiro.lang.util.ClassUtils.ClassLoaderAccessor;
 import org.apache.shiro.lang.util.UnknownClassException;
 
 import java.io.IOException;
@@ -33,9 +34,16 @@
  * @since 1.2
  */
 public class ClassResolvingObjectInputStream extends ObjectInputStream {
+    private final ClassLoaderAccessor additionalClassLoader;
 
     public ClassResolvingObjectInputStream(InputStream inputStream) throws IOException {
+        this(inputStream, null);
+    }
+
+    public ClassResolvingObjectInputStream(InputStream inputStream,
+                                           ClassLoaderAccessor additionalClassLoader) throws IOException {
         super(inputStream);
+        this.additionalClassLoader = additionalClassLoader;
     }
 
     /**
@@ -48,9 +56,9 @@ public ClassResolvingObjectInputStream(InputStream inputStream) throws IOExcepti
      * @throws ClassNotFoundException if the class could not be found in any known ClassLoader
      */
     @Override
-    protected Class<?> resolveClass(ObjectStreamClass osc) throws IOException, ClassNotFoundException {
+    protected Class<?> resolveClass(ObjectStreamClass osc) throws ClassNotFoundException {
         try {
-            return ClassUtils.forName(osc.getName());
+            return ClassUtils.forName(osc.getName(), additionalClassLoader);
         } catch (UnknownClassException e) {
             throw new ClassNotFoundException("Unable to load ObjectStreamClass [" + osc + "]: ", e);
         }

lang/src/main/java/org/apache/shiro/lang/io/DefaultSerializer.java

@@ -23,6 +23,7 @@
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
+import java.io.InputStream;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 
@@ -33,7 +34,6 @@
  * @since 0.9
  */
 public class DefaultSerializer<T> implements Serializer<T> {
-
     /**
      * This implementation serializes the Object by using an {@link ObjectOutputStream} backed by a
      * {@link ByteArrayOutputStream}.  The {@code ByteArrayOutputStream}'s backing byte array is returned.
@@ -80,7 +80,7 @@ public T deserialize(byte[] serialized) throws SerializationException {
         ByteArrayInputStream bais = new ByteArrayInputStream(serialized);
         BufferedInputStream bis = new BufferedInputStream(bais);
         try {
-            ObjectInputStream ois = new ClassResolvingObjectInputStream(bis);
+            ObjectInputStream ois = createObjectInputStream(bis);
             @SuppressWarnings({"unchecked"})
             T deserialized = (T) ois.readObject();
             ois.close();
@@ -90,4 +90,8 @@ public T deserialize(byte[] serialized) throws SerializationException {
             throw new SerializationException(msg, e);
         }
     }
+
+    protected ObjectInputStream createObjectInputStream(InputStream inputStream) throws IOException {
+        return new ClassResolvingObjectInputStream(inputStream);
+    }
 }

lang/src/main/java/org/apache/shiro/lang/util/ClassUtils.java

@@ -194,8 +194,25 @@ public static URL getResource(String name) {
      * @return the located class
      * @throws UnknownClassException if the class cannot be found.
      */
-    @SuppressWarnings("unchecked")
     public static <T> Class<T> forName(String fqcn) throws UnknownClassException {
+        return forName(fqcn, null);
+    }
+
+    /**
+     * Attempts to load the specified class name from the current thread's
+     * {@link Thread#getContextClassLoader() context class loader}, then the
+     * current ClassLoader (<code>ClassUtils.class.getClassLoader()</code>), then the system/application
+     * ClassLoader (<code>ClassLoader.getSystemClassLoader()</code>, in that order.  If any of them cannot locate
+     * the specified class, an <code>UnknownClassException</code> is thrown (our RuntimeException equivalent of
+     * the JRE's <code>ClassNotFoundException</code>.
+     *
+     * @param fqcn the fully qualified class name to load
+     * @param additionalClassLoader accessor to override additional class loader
+     * @return the located class
+     * @throws UnknownClassException if the class cannot be found.
+     */
+    @SuppressWarnings("unchecked")
+    public static <T> Class<T> forName(String fqcn, ClassLoaderAccessor additionalClassLoader) throws UnknownClassException {
         Class<?> clazz = THREAD_CL_ACCESSOR.loadClass(fqcn);
 
         if (clazz == null) {
@@ -211,7 +228,8 @@ public static <T> Class<T> forName(String fqcn) throws UnknownClassException {
                 LOGGER.trace("Unable to load class named [" + fqcn
                         + "] from the org.apache.shiro.lang ClassLoader.  Trying the additionally set ClassLoader...");
             }
-            clazz = ADDITIONAL_CL_ACCESSOR.loadClass(fqcn);
+            clazz = additionalClassLoader != null ? additionalClassLoader.loadClass(fqcn)
+                    : ADDITIONAL_CL_ACCESSOR.loadClass(fqcn);
         }
 
         if (clazz == null) {
@@ -337,7 +355,7 @@ public static void removeAdditionalClassLoader() {
     /**
      * @since 1.0
      */
-    private interface ClassLoaderAccessor {
+    public interface ClassLoaderAccessor {
         Class<?> loadClass(String fqcn);
 
         InputStream getResourceStream(String name);
@@ -348,8 +366,7 @@ private interface ClassLoaderAccessor {
     /**
      * @since 1.0
      */
-    private abstract static class ExceptionIgnoringAccessor implements ClassLoaderAccessor {
-
+    public abstract static class ExceptionIgnoringAccessor implements ClassLoaderAccessor {
         public Class<?> loadClass(String fqcn) {
             Class<?> clazz = null;
             ClassLoader cl = getClassLoader();

web/src/main/java/org/apache/shiro/web/mgt/CookieRememberMeManager.java

@@ -18,10 +18,12 @@
  */
 package org.apache.shiro.web.mgt;
 
+import java.time.Instant;
 import java.util.function.Supplier;
 
 import org.apache.shiro.lang.codec.Base64;
 import org.apache.shiro.mgt.AbstractRememberMeManager;
+import org.apache.shiro.subject.PrincipalCollection;
 import org.apache.shiro.subject.Subject;
 import org.apache.shiro.subject.SubjectContext;
 import org.apache.shiro.web.servlet.Cookie;
@@ -38,7 +40,6 @@
 import jakarta.servlet.http.HttpServletResponse;
 import static org.apache.shiro.session.mgt.DefaultSessionManager.SECURE_COOKIE_DISABLED;
 
-
 /**
  * Remembers a Subject's identity by saving the Subject's {@link Subject#getPrincipals() principals} to a {@link Cookie}
  * for later retrieval.
@@ -72,7 +73,6 @@
  * @since 1.0
  */
 public class CookieRememberMeManager extends AbstractRememberMeManager {
-
     /**
      * The default name of the underlying rememberMe cookie which is {@code rememberMe}.
      */
@@ -139,6 +139,7 @@ public void setCookie(Cookie cookie) {
      * @param subject    the Subject for which the identity is being serialized.
      * @param serialized the serialized bytes to be persisted.
      */
+    @Override
     protected void rememberSerializedIdentity(Subject subject, byte[] serialized) {
 
         if (!WebUtils.isHttp(subject)) {
@@ -191,6 +192,7 @@ private boolean isIdentityRemoved(WebSubjectContext subjectContext) {
      *                       lookup.
      * @return a previously serialized identity byte array or {@code null} if the byte array could not be acquired.
      */
+    @Override
     protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) {
 
         if (!WebUtils.isHttp(subjectContext)) {
@@ -246,6 +248,28 @@ protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext)
         }
     }
 
+    @Override
+    protected PrincipalCollection checkExpiration(RememberedIdentity identity) {
+        int maxAge = getCookie().getMaxAge();
+
+        // Negative maxAge means no explicit persistence lifetime is configured
+        // (e.g. session cookie semantics), so nothing to enforce here.
+        if (maxAge < 0) {
+            return identity.principals();
+        }
+
+        Instant expiresAt = identity.creationTime().plusSeconds(maxAge);
+        if (now().isAfter(expiresAt)) {
+            if (LOGGER.isDebugEnabled()) {
+                LOGGER.debug("Remembered identity expired at [{}] based on cookie maxAge [{}] seconds.",
+                        expiresAt, maxAge);
+            }
+            return null;
+        }
+
+        return identity.principals();
+    }
+
     /**
      * Sometimes a user agent will send the rememberMe cookie value without padding,
      * most likely because {@code =} is a separator in the cookie header.
@@ -276,6 +300,7 @@ protected String ensurePadding(String base64) {
      *
      * @param subject the subject instance for which identity data should be forgotten from the underlying persistence
      */
+    @Override
     protected void forgetIdentity(Subject subject) {
         if (WebUtils.isHttp(subject)) {
             HttpServletRequest request = WebUtils.getHttpRequest(subject);
@@ -293,6 +318,7 @@ protected void forgetIdentity(Subject subject) {
      *
      * @param subjectContext the contextual data, usually provided by a {@link Subject.Builder} implementation
      */
+    @Override
     public void forgetIdentity(SubjectContext subjectContext) {
         if (WebUtils.isHttp(subjectContext)) {
             HttpServletRequest request = WebUtils.getHttpRequest(subjectContext);