[SHIRO-887] FormAuthenticationFilter trims passwords which start and/or end with one or more space character(s)

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 2.0.0-alpha, 1.9.1
• Fix Version/s: 1.10.0
• Assignee: Unassigned
• Reporter: Sebastian Frey
• Created: 25/Jul/22 08:58
• Updated: 07/Oct/22 15:18
• Resolved: 07/Oct/22 15:18

Description

The FormAuthenticationFilter trims passwords which start and/or end with one or more space character(s), which prevents login for users with such passwords.

Since spaces at the start and/or end of a password are totally legit, the password param should not be trimmed, when processed by the FormAuthenticationFilter.

The reason for that behavior is, that in the FormAuthenticationFilter WebUtils.
getCleanParam() is called, which than calls StringUtils.clean(), which trims passed strings.
 
If desired, I would prepare a PR to fix that behavior.

Issue Links

• links to: GitHub Pull Request #369