04. Spring Security Internals Part. 2

• key — remember-me 쿠키에 대한 고유 식별 키
• 미입력시 자동으로 랜덤 텍스트가 입력 됨
• rememberMeParameter — remember-me 쿠키 파라미터명 (기본값 remember-me)
• tokenValiditySeconds — 쿠키 만료 시간 (초 단위)
• alwaysRemember — 항상 remember-me 를 활성화 시킴 (기본값 false)

http
// ... 생략 ...
	.rememberMe()
		.key("my-remember-me")
		.rememberMeParameter("remember-me")
		.tokenValiditySeconds(300)
		.alwaysRemember(false)
	  .and()
// ... 생략 ...

• TokenBasedRememberMeServices — MD5 해시 알고리즘 기반 쿠키 검증
• PersistentTokenBasedRememberMeServices — 외부 데이터베이스에서 인증에 필요한 데이터를 가져오고 검증함
• 사용자마다 고유의 Series 식별자가 생성되고, 인증 시 마다 매번 갱신되는 임의의 토큰 값을 사용하여 보다 높은 보안성을 제공함

private void doFilter(HttpServletRequest request, HttpServletResponse response, FilterChain chain) 
    throws IOException, ServletException {
	if (SecurityContextHolder.getContext().getAuthentication() != null) {
		this.logger.debug(LogMessage
				.of(() -> "SecurityContextHolder not populated with remember-me token, as it already contained: '"
						+ SecurityContextHolder.getContext().getAuthentication() + "'"));
		chain.doFilter(request, response);
		return;
	}
	Authentication rememberMeAuth = this.rememberMeServices.autoLogin(request, response);
	if (rememberMeAuth != null) {
		// Attempt authenticaton via AuthenticationManager
		try {
			rememberMeAuth = this.authenticationManager.authenticate(rememberMeAuth);
			// Store to SecurityContextHolder
			SecurityContextHolder.getContext().setAuthentication(rememberMeAuth);
			onSuccessfulAuthentication(request, response, rememberMeAuth);
			this.logger.debug(LogMessage.of(() -> "SecurityContextHolder populated with remember-me token: '"
					+ SecurityContextHolder.getContext().getAuthentication() + "'"));
			if (this.eventPublisher != null) {
				this.eventPublisher.publishEvent(new InteractiveAuthenticationSuccessEvent(
						SecurityContextHolder.getContext().getAuthentication(), this.getClass()));
			}
			if (this.successHandler != null) {
				this.successHandler.onAuthenticationSuccess(request, response, rememberMeAuth);
				return;
			}
		}
		catch (AuthenticationException ex) {
			this.logger.debug(LogMessage
					.format("SecurityContextHolder not populated with remember-me token, as AuthenticationManager "
							+ "rejected Authentication returned by RememberMeServices: '%s'; "
							+ "invalidating remember-me token", rememberMeAuth),
					ex);
			this.rememberMeServices.loginFail(request, response);
			onUnsuccessfulAuthentication(request, response, ex);
		}
	}
	chain.doFilter(request, response);
}