Details
-
Bug
-
Status: Open
-
Major
-
Resolution: Unresolved
-
1.2.4
-
None
-
None
-
None
Description
The "remember me" cookie has a max age limit which is configurable in Shiro (see CookieRememberMeManager).
However, Shiro does not enforce this limit at all – it trusts the client to expire the "remember me" cookie after the requested time limit.
Because the cookie value has no server-side age verification, if a malicious client gets a copy of the remember me cookie, then it will last forever, regardless of the max age limit configured in Shiro.
See also http://stackoverflow.com/questions/26639205/shiro-how-does-remember-me-work/35633675