Proper handling if the account is no longer allowed login.

2026-08-04 17:27:13 +00:00 · 2005-03-18 00:06:09 +00:00
parent 748f427a80
commit 07e46fe4d5
1 changed files with 12 additions and 0 deletions
@@ -222,6 +222,18 @@ public class TokenBasedRememberMeServices implements RememberMeServices,
                            return null;
                        }

+                        // Immediately reject if the user is not allowed to login
+                        if (!userDetails.isAccountNonExpired()
+                            || !userDetails.isCredentialsNonExpired()
+                            || !userDetails.isEnabled()) {
+                            cancelCookie(request, response,
+                                "Cookie token[0] contained username '"
+                                + cookieTokens[0]
+                                + "' but account has expired, credentials have expired, or user is disabled");
+
+                            return null;
+                        }
+
                        // Check signature of token matches remaining details
                        // Must do this after user lookup, as we need the DAO-derived password
                        // If efficiency was a major issue, just add in a UserCache implementation,