Top Description Inners Methods
jakarta.security.enterprise.authentication.mechanism.http

public @Interface RememberMe

extends Annotation
Known Direct Implementers
jakarta.security.enterprise.authentication.mechanism.http.RememberMe.Literal
Annotations
@Inherited
@InterceptorBinding
@Retention:RUNTIME
@Target:TYPE
Static Imports
java.lang.annotation.ElementType.TYPE, .RetentionPolicy.RUNTIME
The RememberMe annotation provides an application the ability to declaratively designate that an authentication mechanism effectively "remembers" the authentication and auto applies this with every request.

For the remember me function the credentials provided by the caller are exchanged for a (long-lived) token which is send to the user as the value of a cookie, in a similar way to how the HTTP session ID is send. It should be realized that this token effectively becomes the credential to establish the caller's identity within the application and care should be taken to handle and store the token securely. E.g. by using this feature with a secure transport (SSL/HTTPS), storing a strong hash instead of the actual token, and implementing an expiration policy.

The token is vended by a special purpose IdentityStore-like artifact; an implementation of the RememberMeIdentityStore.

This support is provided via an implementation of an interceptor spec interceptor that conducts the necessary logic.

Example: 


    @RequestScoped
    @RememberMe
    public class CustomAuthenticationMechanism implements HttpAuthenticationMechanism {
        // ...
    }

Jakarta Expression Language expressions in attributes of type String are evaluated for every request requiring authentication. Both immediate and deferred syntax is supported, but effectively the semantics are always deferred.

Note

this facility DOES NOT constitute any kind of "session management" system, but instead represents a special purpose authentication mechanism using a long-lived token, that is vended and validated by the RememberMeIdentityStore.

Nested and Inner Type Summary

Modifier and TypeClass and Description
public static class
RememberMe.Literal

Supports inline instantiation of the RememberMe annotation.

Method Summary

Modifier and TypeMethod and Description
public boolean

Returns:

true if the cookie should be sent only with HTTP requests (and not be made available to client-side scripting code), false otherwise.
cookieHttpOnly()

Flag to indicate that the remember me cookie should not be exposed to client-side scripting code, and should only be sent with HTTP requests.

public String

Returns:

an expression evaluating to true if the cookie should be sent only with HTTP requests , false otherwise.
cookieHttpOnlyExpression()

Jakarta Expression Language expression variant of cookieHttpOnly().

public int

Returns:

Max age in seconds
cookieMaxAgeSeconds()

Max age in seconds for the remember me cookie.

public String

Returns:

an expression evaluating to an integer designating the max age in seconds for the remember me cookie.
cookieMaxAgeSecondsExpression()

Jakarta Expression Language expression variant of cookieMaxAgeSeconds().

public String

Returns:

The name of the cookie
cookieName()

Name of the remember me cookie.

public boolean

Returns:

true if the cookie should be sent using a secure protocol only false for any protocol.
cookieSecureOnly()

Flag to indicate that the remember me cookie should only be sent using a secure protocol (e.g. HTTPS or SSL).

public String

Returns:

an expression evaluating to an integer designating the max age in seconds for the remember me cookie.
cookieSecureOnlyExpression()

Jakarta Expression Language expression variant of cookieSecureOnly().

public boolean

Returns:

Flag to determine if remember me should be used
isRememberMe()

Flag to determine if remember me should be used.

public String

Returns:

Jakarta Expression Language expression to determine if remember me should be used
isRememberMeExpression()

Jakarta Expression Language expression to determine if remember me should be used.

Inherited from java.lang.annotation.Annotation:
annotationTypeequalshashCodetoString

Method Detail

cookieHttpOnlyback to summary
public boolean cookieHttpOnly()

Flag to indicate that the remember me cookie should not be exposed to client-side scripting code, and should only be sent with HTTP requests.

Returns:boolean

true if the cookie should be sent only with HTTP requests (and not be made available to client-side scripting code), false otherwise.

Annotations
@Nonbinding
See Also
Cookie#setHttpOnly(boolean)
cookieHttpOnlyExpressionback to summary
public String cookieHttpOnlyExpression()

Jakarta Expression Language expression variant of cookieHttpOnly(). The expression needs to evaluate to a boolean outcome. All named CDI beans are available to the expression as well as default classes as specified by Jakarta Expression Language 3.0 for the ELProcessor and the implicit objects "self" which refers to the interceptor target and "httpMessageContext" which refers to the current HttpMessageContext. If both this attribute and cookieHttpOnly() are specified, this attribute takes precedence.

Returns:String

an expression evaluating to true if the cookie should be sent only with HTTP requests , false otherwise.

Annotations
@Nonbinding
cookieMaxAgeSecondsback to summary
public int cookieMaxAgeSeconds()

Max age in seconds for the remember me cookie. Defaults to one day.

Returns:int

Max age in seconds

Annotations
@Nonbinding
See Also
Cookie#setMaxAge(int)
cookieMaxAgeSecondsExpressionback to summary
public String cookieMaxAgeSecondsExpression()

Jakarta Expression Language expression variant of cookieMaxAgeSeconds(). The expression needs to evaluate to an integer outcome. All named CDI beans are available to the expression as well as default classes as specified by Jakarta Expression Language 3.0 for the ELProcessor and the implicit objects "self" which refers to the interceptor target and "httpMessageContext" which refers to the current HttpMessageContext. If both this attribute and cookieMaxAgeSeconds() are specified, this attribute takes precedence.

Returns:String

an expression evaluating to an integer designating the max age in seconds for the remember me cookie.

Annotations
@Nonbinding
cookieNameback to summary
public String cookieName()

Name of the remember me cookie.

Returns:String

The name of the cookie

Annotations
@Nonbinding
See Also
Cookie#getName()
cookieSecureOnlyback to summary
public boolean cookieSecureOnly()

Flag to indicate that the remember me cookie should only be sent using a secure protocol (e.g. HTTPS or SSL).

Returns:boolean

true if the cookie should be sent using a secure protocol only false for any protocol.

Annotations
@Nonbinding
See Also
Cookie#setSecure(boolean)
cookieSecureOnlyExpressionback to summary
public String cookieSecureOnlyExpression()

Jakarta Expression Language expression variant of cookieSecureOnly(). The expression needs to evaluate to a boolean outcome. All named CDI beans are available to the expression as well as default classes as specified by Jakarta Expression Language 3.0 for the ELProcessor and the implicit objects "self" which refers to the interceptor target and "httpMessageContext" which refers to the current HttpMessageContext. If both this attribute and cookieSecureOnly() are specified, this attribute takes precedence.

Returns:String

an expression evaluating to an integer designating the max age in seconds for the remember me cookie.

Annotations
@Nonbinding
isRememberMeback to summary
public boolean isRememberMe()

Flag to determine if remember me should be used.

Returns:boolean

Flag to determine if remember me should be used

Annotations
@Nonbinding
isRememberMeExpressionback to summary
public String isRememberMeExpression()

Jakarta Expression Language expression to determine if remember me should be used. This is evaluated for every request requiring authentication. The expression needs to evaluate to a boolean outcome. All named CDI beans are available to the expression as well as default classes as specified by Jakarta Expression Language 3.0 for the ELProcessor and the implicit objects "self" which refers to the interceptor target and "httpMessageContext" which refers to the current HttpMessageContext.

Returns:String

Jakarta Expression Language expression to determine if remember me should be used

Annotations
@Nonbinding
jakarta.security.enterprise.authentication.mechanism.http back to summary

public final Class RememberMe.Literal

extends AnnotationLiteral<RememberMe>
implements RememberMe
Class Inheritance
All Implemented Interfaces
jakarta.security.enterprise.authentication.mechanism.http.RememberMe, java.lang.annotation.Annotation
Supports inline instantiation of the RememberMe annotation.
Since
3.0

Field Summary

Modifier and TypeField and Description
private final boolean
cookieHttpOnly

private final String
cookieHttpOnlyExpression

private final int
cookieMaxAgeSeconds

private final String
cookieMaxAgeSecondsExpression

private final String
cookieName

private final boolean
cookieSecureOnly

private final String
cookieSecureOnlyExpression

public static final RememberMe.Literal
INSTANCE

Default instance of the RememberMe Interceptor Binding.

private final boolean
isRememberMe

private final String
isRememberMeExpression

private static final long
serialVersionUID

Hides jakarta.enterprise.util.AnnotationLiteral.serialVersionUID.

Constructor Summary

AccessConstructor and Description
private
Literal(int cookieMaxAgeSeconds, String cookieMaxAgeSecondsExpression, boolean cookieSecureOnly, String cookieSecureOnlyExpression, boolean cookieHttpOnly, String cookieHttpOnlyExpression, String cookieName, boolean isRememberMe, String isRememberMeExpression)

Method Summary

Modifier and TypeMethod and Description
public boolean
cookieHttpOnly()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieHttpOnly.

Flag to indicate that the remember me cookie should not be exposed to client-side scripting code, and should only be sent with HTTP requests.

public String
cookieHttpOnlyExpression()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieHttpOnlyExpression.

Jakarta Expression Language expression variant of cookieHttpOnly().

public int
cookieMaxAgeSeconds()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieMaxAgeSeconds.

Max age in seconds for the remember me cookie.

public String
cookieMaxAgeSecondsExpression()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieMaxAgeSecondsExpression.

Jakarta Expression Language expression variant of cookieMaxAgeSeconds().

public String
cookieName()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieName.

Name of the remember me cookie.

public boolean
cookieSecureOnly()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieSecureOnly.

Flag to indicate that the remember me cookie should only be sent using a secure protocol (e.g. HTTPS or SSL).

public String
cookieSecureOnlyExpression()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieSecureOnlyExpression.

Jakarta Expression Language expression variant of cookieSecureOnly().

public boolean
isRememberMe()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.isRememberMe.

Flag to determine if remember me should be used.

public String
isRememberMeExpression()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.isRememberMeExpression.

Jakarta Expression Language expression to determine if remember me should be used.

public static RememberMe.Literal

Returns:

instance of the RememberMe Interceptor Binding
of(int
Max age in seconds for the remember me cookie.
cookieMaxAgeSeconds, String
Jakarta Expression Language expression variant of cookieMaxAgeSeconds
cookieMaxAgeSecondsExpression, boolean
Flag to indicate that the remember me cookie should only be sent using a secure protocol
cookieSecureOnly, String
Jakarta Expression Language expression variant of cookieSecureOnly
cookieSecureOnlyExpression, boolean
true if the cookie should be sent only with HTTP requests
cookieHttpOnly, String
Jakarta Expression Language expression variant of cookieHttpOnly
cookieHttpOnlyExpression, String
Name of the remember me cookie.
cookieName, boolean
Flag to determine if remember me should be used.
isRememberMe, String
Jakarta Expression Language expression variant of isRememberMe
isRememberMeExpression)

Instance of the RememberMe Interceptor Binding.

Inherited from jakarta.enterprise.util.AnnotationLiteral:
annotationTypeequalshashCodetoString

Field Detail

cookieHttpOnlyback to summary
private final boolean cookieHttpOnly
cookieHttpOnlyExpressionback to summary
private final String cookieHttpOnlyExpression
cookieMaxAgeSecondsback to summary
private final int cookieMaxAgeSeconds
cookieMaxAgeSecondsExpressionback to summary
private final String cookieMaxAgeSecondsExpression
cookieNameback to summary
private final String cookieName
cookieSecureOnlyback to summary
private final boolean cookieSecureOnly
cookieSecureOnlyExpressionback to summary
private final String cookieSecureOnlyExpression
INSTANCEback to summary
public static final RememberMe.Literal INSTANCE

Default instance of the RememberMe Interceptor Binding.

isRememberMeback to summary
private final boolean isRememberMe
isRememberMeExpressionback to summary
private final String isRememberMeExpression
serialVersionUIDback to summary
private static final long serialVersionUID

Hides jakarta.enterprise.util.AnnotationLiteral.serialVersionUID.

Constructor Detail

Literalback to summary
private Literal(int cookieMaxAgeSeconds, String cookieMaxAgeSecondsExpression, boolean cookieSecureOnly, String cookieSecureOnlyExpression, boolean cookieHttpOnly, String cookieHttpOnlyExpression, String cookieName, boolean isRememberMe, String isRememberMeExpression)

Method Detail

cookieHttpOnlyback to summary
public boolean cookieHttpOnly()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieHttpOnly.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieHttpOnly.

Flag to indicate that the remember me cookie should not be exposed to client-side scripting code, and should only be sent with HTTP requests.

Returns:boolean

true if the cookie should be sent only with HTTP requests (and not be made available to client-side scripting code), false otherwise.

Annotations
@Override
cookieHttpOnlyExpressionback to summary
public String cookieHttpOnlyExpression()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieHttpOnlyExpression.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieHttpOnlyExpression.

Jakarta Expression Language expression variant of cookieHttpOnly(). The expression needs to evaluate to a boolean outcome. All named CDI beans are available to the expression as well as default classes as specified by Jakarta Expression Language 3.0 for the ELProcessor and the implicit objects "self" which refers to the interceptor target and "httpMessageContext" which refers to the current HttpMessageContext. If both this attribute and cookieHttpOnly() are specified, this attribute takes precedence.

Returns:String

an expression evaluating to true if the cookie should be sent only with HTTP requests , false otherwise.

Annotations
@Override
cookieMaxAgeSecondsback to summary
public int cookieMaxAgeSeconds()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieMaxAgeSeconds.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieMaxAgeSeconds.

Max age in seconds for the remember me cookie. Defaults to one day.

Returns:int

Max age in seconds

Annotations
@Override
cookieMaxAgeSecondsExpressionback to summary
public String cookieMaxAgeSecondsExpression()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieMaxAgeSecondsExpression.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieMaxAgeSecondsExpression.

Jakarta Expression Language expression variant of cookieMaxAgeSeconds(). The expression needs to evaluate to an integer outcome. All named CDI beans are available to the expression as well as default classes as specified by Jakarta Expression Language 3.0 for the ELProcessor and the implicit objects "self" which refers to the interceptor target and "httpMessageContext" which refers to the current HttpMessageContext. If both this attribute and cookieMaxAgeSeconds() are specified, this attribute takes precedence.

Returns:String

an expression evaluating to an integer designating the max age in seconds for the remember me cookie.

Annotations
@Override
cookieNameback to summary
public String cookieName()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieName.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieName.

Name of the remember me cookie.

Returns:String

The name of the cookie

Annotations
@Override
cookieSecureOnlyback to summary
public boolean cookieSecureOnly()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieSecureOnly.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieSecureOnly.

Flag to indicate that the remember me cookie should only be sent using a secure protocol (e.g. HTTPS or SSL).

Returns:boolean

true if the cookie should be sent using a secure protocol only false for any protocol.

Annotations
@Override
cookieSecureOnlyExpressionback to summary
public String cookieSecureOnlyExpression()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieSecureOnlyExpression.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.cookieSecureOnlyExpression.

Jakarta Expression Language expression variant of cookieSecureOnly(). The expression needs to evaluate to a boolean outcome. All named CDI beans are available to the expression as well as default classes as specified by Jakarta Expression Language 3.0 for the ELProcessor and the implicit objects "self" which refers to the interceptor target and "httpMessageContext" which refers to the current HttpMessageContext. If both this attribute and cookieSecureOnly() are specified, this attribute takes precedence.

Returns:String

an expression evaluating to an integer designating the max age in seconds for the remember me cookie.

Annotations
@Override
isRememberMeback to summary
public boolean isRememberMe()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.isRememberMe.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.isRememberMe.

Flag to determine if remember me should be used.

Returns:boolean

Flag to determine if remember me should be used

Annotations
@Override
isRememberMeExpressionback to summary
public String isRememberMeExpression()

Implements jakarta.security.enterprise.authentication.mechanism.http.RememberMe.isRememberMeExpression.

Doc from jakarta.security.enterprise.authentication.mechanism.http.RememberMe.isRememberMeExpression.

Jakarta Expression Language expression to determine if remember me should be used. This is evaluated for every request requiring authentication. The expression needs to evaluate to a boolean outcome. All named CDI beans are available to the expression as well as default classes as specified by Jakarta Expression Language 3.0 for the ELProcessor and the implicit objects "self" which refers to the interceptor target and "httpMessageContext" which refers to the current HttpMessageContext.

Returns:String

Jakarta Expression Language expression to determine if remember me should be used

Annotations
@Override
ofback to summary
public static RememberMe.Literal of(int cookieMaxAgeSeconds, String cookieMaxAgeSecondsExpression, boolean cookieSecureOnly, String cookieSecureOnlyExpression, boolean cookieHttpOnly, String cookieHttpOnlyExpression, String cookieName, boolean isRememberMe, String isRememberMeExpression)

Instance of the RememberMe Interceptor Binding.

Parameters
cookieMaxAgeSeconds:int

Max age in seconds for the remember me cookie.

cookieMaxAgeSecondsExpression:String

Jakarta Expression Language expression variant of cookieMaxAgeSeconds

cookieSecureOnly:boolean

Flag to indicate that the remember me cookie should only be sent using a secure protocol

cookieSecureOnlyExpression:String

Jakarta Expression Language expression variant of cookieSecureOnly

cookieHttpOnly:boolean

true if the cookie should be sent only with HTTP requests

cookieHttpOnlyExpression:String

Jakarta Expression Language expression variant of cookieHttpOnly

cookieName:String

Name of the remember me cookie.

isRememberMe:boolean

Flag to determine if remember me should be used.

isRememberMeExpression:String

Jakarta Expression Language expression variant of isRememberMe

Returns:RememberMe.Literal

instance of the RememberMe Interceptor Binding