From 26ae590c688248b6f5fbc26704659ce68df48b4f Mon Sep 17 00:00:00 2001 From: Scott Murphy Date: Sun, 11 Aug 2019 13:21:37 -0600 Subject: [PATCH] Check that userdetails for username exists. #7251 --- .../rememberme/TokenBasedRememberMeServices.java | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java b/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java index 9ea38a8476..634c9eb632 100644 --- a/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java +++ b/web/src/main/java/org/springframework/security/web/authentication/rememberme/TokenBasedRememberMeServices.java @@ -123,6 +123,11 @@ public class TokenBasedRememberMeServices extends AbstractRememberMeServices { UserDetails userDetails = getUserDetailsService().loadUserByUsername( cookieTokens[0]); + if (userDetails == null) { + throw new InvalidCookieException("Cookie token[0] contained username '" + + cookieTokens[0] + "' that does not exist."); + } + // Check signature of token matches remaining details. // Must do this after user lookup, as we need the DAO-derived password. // If efficiency was a major issue, just add in a UserCache implementation,