[WICKET-5855] RememberMe functionality seems to be broken after the change of the default crypt factory

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 7.0.0-M5, 6.19.0
• Fix Version/s: 6.20.0, 7.0.0-M6
• Component/s: wicket-auth-roles
• Assignee: Martin Tzvetanov Grigorov
• Reporter: Martin Tzvetanov Grigorov
• Created: 10/Mar/15 22:25
• Updated: 30/Mar/15 19:10
• Resolved: 30/Mar/15 19:10

Description

The fix for CVE-2014-7808 seems to break the "rememberMe" functionality in wicket-auth-roles.
DefaultAuthenticationStrategy uses the crypt factory to encrypt the user credentials. After restart of the application a new crypt factory is created with a new secret key. Now it is not possible to decrypt the saved credentials.