[SHIRO-441] Explain how "Remember Me" works under the hood and that you might want to use a custom cipher key

• Type: Documentation
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: 1.2.1
• Component/s: Documentation, Sample Apps
• Assignee: Unassigned
• Reporter: Marian Seitner
• Created: 20/May/13 13:34
• Updated: 26/Feb/16 03:23

Description

Neither the tutorial (http://shiro.apache.org/tutorial.html (section "Using Shiro")) nor the the reference documentation (http://shiro.apache.org/authentication.html#Authentication-Rememberedvs.Authenticated (chapter "Authentication")) give any hints that without a custom cipher key the - publicly available - default key will be used (defined in http://grepcode.com/file/repo1.maven.org/maven2/com.ning/metrics.collector/1.2.1/org/apache/shiro/mgt/AbstractRememberMeManager.java/).

Especially the statement in the tutorial is questionable: "this is all you have to do to support 'remember me' (no config - built in!)". While true and fairly obvious to advanced developers the potential security implications should be better explained.

Issue Links

• relates to: SHIRO-550 Randomize default remember me cipher