[SLING-10290] Every request renews sling.formauth token

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: Form Based Authentication 1.0.20
• Fix Version/s: Form Based Authentication 1.0.24
• Component/s: Authentication
• Assignee: Eric Norman
• Reporter: Cris Rockwell
• Created: 09/Apr/21 18:19
• Updated: 12/Jun/21 01:32
• Resolved: 21/May/21 18:40

Description

When using Apache Sling Form Based Authentication Handler
Every request and subrequest sets a new value for `sling.formauth`

Analyzing the code indicates that it not the intended behavior,
and the cookie value of `sling.formauth` should be consistent for 30 minutes
according to the default value of form.auth.timeout

Debugging shows that the method getCookieAuthData always returns null.... AuthenticationInfo properties are user.jcr.credentials, sling.authType and user.name. But this is not a property called sling.formauth