title: Java EE web application "remember me" auto login done right?
body: <p><strong>The Situation:</strong><br /></p>
  
  <ul>
  <li>A java EE web application with user authentication based on username/password</li>
  <li>Password verification is not done by the application itself. It uses <a href="http://download.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login%28java.lang.String,%20java.lang.String%29" rel="nofollow noreferrer">HttpServletRequest.login()</a> and the security-realm is defined in the application server.</li>
  <li>The application uses authorization (@RolesAllowed annotation)</li>
  <li>The application allows the user to be remembered, so he doesn't need to authenticate every time</li>
  </ul>
  
  <p>I think this are quite common requirements for web applications, but the last requirement is not that easy to achieve, and I haven't found a standard way of implementing this. I like to show my ideas and explain why I think they are not perfect.</p>
  
  <p><strong>1 Just keep the HttpSession open</strong><br />
  Actually this was my preferred way in the first place. I thought that using <a href="http://docs.oracle.com/javaee/7/api/javax/servlet/http/HttpSession.html#setMaxInactiveInterval%28int%29" rel="nofollow noreferrer">HttpSessioin.setMaxInactiveInterval()</a> would do the trick. Basically it does but if the Sessions are not cleaned up properly and you have a lot of users this could be resource problem. <a href="https://stackoverflow.com/questions/19426453/how-to-close-a-vaadin-session-but-keep-http-session-when-browser-closed">Here</a> my own question to show that cleaning up a HttpSession is not easy all the time. </p>
  
  <p><strong>2 Use a "remember me" cookie</strong><br />
  Why not just generate a UUID and send it as cookie and than check for it when the HttpSession is new. This works pretty good if the only thing the security realm is used for is to check username/password. If authorization or functions like <a href="http://docs.oracle.com/javaee/7/api/javax/servlet/http/HttpServletRequest.html#getUserPrincipal%28%29" rel="nofollow noreferrer">getUserPrincipal()</a> are used, then it is not possible. I haven't found a way to use <a href="http://download.oracle.com/javaee/6/api/javax/servlet/http/HttpServletRequest.html#login%28java.lang.String,%20java.lang.String%29" rel="nofollow noreferrer">HttpServletRequest.login()</a> or a similar function with a token instead of a password.</p>
  
  <p><strong>3 Use a "remember me" cookie and use my own authorization</strong><br />
  Well, sure, this is possible, but I like the easy way to restrict access to some beans or methods. It makes it harder for me to implementing something where a user could access something he shouldn't. </p>
  
  <p><strong>4 Use a "remember me" cookie with the password in it</strong><br />
  Stupid! Next!</p>
  
  <p><strong>5 Use a "remember me" cookie and keep the password</strong><br />
  The idea is to remember the password and a relation to to the cookie, so the HttpServletRequest.login() could be used with the password.
  This is the method explained in this Answer: <a href="https://stackoverflow.com/a/5083809/210380">https://stackoverflow.com/a/5083809/210380</a> <br/>
  I think this method has a big problem: <em>Never store passwords unencrypted</em> <br />
  One could think about just keeping the passwords in memory, but I don't like that either. The application could be used anywhere and I don't want to be responsible if all passwords of a company are leaked because someone got temporally access to the server and made a memory dump.
  <br />
  <br /></p>
  
  <p><strong>My current solution</strong><br />
  Based on these thoughts I came up with my own solution. I'm using two cookies. The first is just a "remember me" cookie with the String representation of a <a href="http://docs.oracle.com/javase/6/docs/api/java/util/UUID.html" rel="nofollow noreferrer">UUID</a>. This UUID is also remembered in memory or a database together with the username. The second cookie also contains a String representation of a UUID and is used to encrypt the password. The encrypted password is remembered together with the UUID of the first cookie in a database or memory. The UUID from the the second cookie is not kept. <em>Not in a database nor in memory</em>. To encrypt and decrypt the user password I'm using <a href="http://www.jasypt.org/api/jasypt/1.8/org/jasypt/encryption/pbe/StandardPBEStringEncryptor.html" rel="nofollow noreferrer">StandardPBEStringEncryptor from jasypt</a>. <br />
  When a user tries to reauthenticate with this cookies I read them both, search for the username and the encrypted password based on the first cookie, decrypt the password with the second cookie and use HttpServletRequest.login() with username and password. Then I delete the encrypted password stored on the server, and restart the process with two new UUIDs. </p>
  
  <p><strong>The questions</strong></p>
  
  <ol>
  <li><p>Is there really no standardized solution for this?</p></li>
  <li><p>Are there any security problems in my solution I don't see? <br />
  e.g. could it be unwise to encrypt the password with a new key on re-authentication</p></li>
  <li><p>Is StandardPBEStringEncryptor a good choice for this task?</p></li>
  <li><p>Is my solution overkill and I'm wasting my time?</p></li>
  </ol>
  
  <p>Thanks</p>