Bug 887972

Summary:	Ensure that generated rememberme token is really unique
Product:	[JBoss] JBoss Enterprise Portal Platform 6	Reporter:	mposolda
Component:	Portal	Assignee:	mposolda
Status:	CLOSED CURRENTRELEASE	QA Contact:	vramik
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.0.0	CC:	epp-bugs, mvanco, theute
Target Milestone:	ER05
Target Release:	6.0.0
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-04-16 08:55:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description mposolda 2012-12-17 17:38:15 UTC

See https://issues.jboss.org/browse/GTNPORTAL-2771

Comment 1 vramik 2013-01-29 12:45:55 UTC

I've verified that changes from https://github.com/gatein/gatein-portal/pull/296 are applied in 	git://git.app.eng.bos.redhat.com/gatein/gatein-portal.git tag 3.5.1.Final-redhat-1, which is tag for er05

Comment 2 vramik 2013-01-29 15:14:33 UTC

I tried following scenario:
I've used jar with org.exoplatform.web.security.SimpleGeneratorCookieTokenService test class and configured jpp to use this class instead of original one.

Then I tried to log in wit rememberme checkbox checked and cookie with "rememberme1" was generated. Then I erased cookies and log in with rememberme checkbox checked again and cookie with "rememberme2" was generated.
Then I erased cookies and log in with rememberme checkbox checked again and cookie with "rememberme3" was generated and in log is: 16:06:53,727 DEBUG [org.exoplatform.web.security.SimpleGeneratorCookieTokenService] (http-/127.0.0.1:8080-2) Token rememberme2 already exists. Other token will be generated

Comment 3 mposolda 2013-01-29 19:37:46 UTC

Thanks Vlasta! I think this is sufficient for verification of this BZ.