{"action":"created","issue":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/3722","repository_url":"https://api.github.com/repos/jhipster/generator-jhipster","labels_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/3722/labels{/name}","comments_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/3722/comments","events_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/3722/events","html_url":"https://github.com/jhipster/generator-jhipster/issues/3722","id":160579280,"number":3722,"title":"in production mode cookie theft exception is thrown every time when user's session expires jhipster v3.1.0 ","user":{"login":"maddy1512","id":8413538,"avatar_url":"https://avatars3.githubusercontent.com/u/8413538?v=3","gravatar_id":"","url":"https://api.github.com/users/maddy1512","html_url":"https://github.com/maddy1512","followers_url":"https://api.github.com/users/maddy1512/followers","following_url":"https://api.github.com/users/maddy1512/following{/other_user}","gists_url":"https://api.github.com/users/maddy1512/gists{/gist_id}","starred_url":"https://api.github.com/users/maddy1512/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/maddy1512/subscriptions","organizations_url":"https://api.github.com/users/maddy1512/orgs","repos_url":"https://api.github.com/users/maddy1512/repos","events_url":"https://api.github.com/users/maddy1512/events{/privacy}","received_events_url":"https://api.github.com/users/maddy1512/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/milestones/81","html_url":"https://github.com/jhipster/generator-jhipster/milestone/81","labels_url":"https://api.github.com/repos/jhipster/generator-jhipster/milestones/81/labels","id":1893990,"number":81,"title":"3.5.0","description":"","creator":{"login":"jdubois","id":316835,"avatar_url":"https://avatars2.githubusercontent.com/u/316835?v=3","gravatar_id":"","url":"https://api.github.com/users/jdubois","html_url":"https://github.com/jdubois","followers_url":"https://api.github.com/users/jdubois/followers","following_url":"https://api.github.com/users/jdubois/following{/other_user}","gists_url":"https://api.github.com/users/jdubois/gists{/gist_id}","starred_url":"https://api.github.com/users/jdubois/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jdubois/subscriptions","organizations_url":"https://api.github.com/users/jdubois/orgs","repos_url":"https://api.github.com/users/jdubois/repos","events_url":"https://api.github.com/users/jdubois/events{/privacy}","received_events_url":"https://api.github.com/users/jdubois/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":100,"state":"closed","created_at":"2016-07-20T12:17:58Z","updated_at":"2017-05-03T21:46:41Z","due_on":null,"closed_at":"2016-07-20T21:53:18Z"},"comments":24,"created_at":"2016-06-16T05:16:21Z","updated_at":"2017-05-03T22:04:51Z","closed_at":null,"body":"I have been using jhipster v3.1.0 in production mode for my internal system and I am stuck with this particular problem that whenever any user's session expires they are thrown a cookie-theft exception and shown an error page, also after reloading the webpage still same exception is thrown again and again and the users cannot login until they clear their particular cookie. The autologin part some how is not working and below is the stacktrace of the exception that is thrown. This exception only occurs in prod mode.\n\n```\nForwarding to error page from request [/index.html] due to exception$\norg.springframework.security.web.authentication.rememberme.CookieTheftException: Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.\n        at com.adelement.security.CustomPersistentRememberMeServices.getPersistentToken(CustomPersistentRememberMeServices.java:178)\n        at com.adelement.security.CustomPersistentRememberMeServices.processAutoLoginCookie(CustomPersistentRememberMeServices.java:87)\n        at org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices.autoLogin(AbstractRememberMeServices.java:113)\n        at sun.reflect.GeneratedMethodAccessor485.invoke(Unknown Source)\n        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)\n        at java.lang.reflect.Method.invoke(Method.java:498)\n        at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:302)\n        at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:202)\n        at com.sun.proxy.$Proxy152.autoLogin(Unknown Source)\n        at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:97)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:169)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:48)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:205)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:120)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at com.adelement.web.filter.CsrfCookieGeneratorFilter.doFilterInternal(CsrfCookieGeneratorFilter.java:34)\nat org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.csrf.CsrfFilter.doFilterInternal(CsrfFilter.java:96)\n        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:64)\n        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:91)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:53)\n        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n        at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:330)\n        at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:213)\n        at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:176)\n        at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:346)\n        at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:262)\n        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)\n        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)\n        at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99)\n        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)\n        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)\n        at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:87)\n        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)\n        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)\n        at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:77)\n        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)\n        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)\n        at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:121)\n        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)\n        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)\n        at org.springframework.boot.context.web.ErrorPageFilter.doFilter(ErrorPageFilter.java:120)\n        at org.springframework.boot.context.web.ErrorPageFilter.access$000(ErrorPageFilter.java:61)\n        at org.springframework.boot.context.web.ErrorPageFilter$1.doFilterInternal(ErrorPageFilter.java:95)\n        at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)\n        at org.springframework.boot.context.web.ErrorPageFilter.doFilter(ErrorPageFilter.java:113)\n        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)\n        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)\n        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)\n        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)\n        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)\n        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)\n        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)\n        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616)\n        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)\n        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:522)\n        at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1095)\n        at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:672)\n        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1502)\n        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1458)\n        at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)\n        at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)\n        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)\n        at java.lang.Thread.run(Thread.java:745)\n```\n"},"comment":{"url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/comments/299048979","html_url":"https://github.com/jhipster/generator-jhipster/issues/3722#issuecomment-299048979","issue_url":"https://api.github.com/repos/jhipster/generator-jhipster/issues/3722","id":299048979,"user":{"login":"bluegaspode","id":529675,"avatar_url":"https://avatars3.githubusercontent.com/u/529675?v=3","gravatar_id":"","url":"https://api.github.com/users/bluegaspode","html_url":"https://github.com/bluegaspode","followers_url":"https://api.github.com/users/bluegaspode/followers","following_url":"https://api.github.com/users/bluegaspode/following{/other_user}","gists_url":"https://api.github.com/users/bluegaspode/gists{/gist_id}","starred_url":"https://api.github.com/users/bluegaspode/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bluegaspode/subscriptions","organizations_url":"https://api.github.com/users/bluegaspode/orgs","repos_url":"https://api.github.com/users/bluegaspode/repos","events_url":"https://api.github.com/users/bluegaspode/events{/privacy}","received_events_url":"https://api.github.com/users/bluegaspode/received_events","type":"User","site_admin":false},"created_at":"2017-05-03T22:04:51Z","updated_at":"2017-05-03T22:04:51Z","body":"When its not good enough (yet), then clean code is better than the added complexity of the last change I guess. \r\nI'd suggest reverting the last change, when the next release is due - and later on having a clean start when there is more time.\r\n\r\nPersonally I'm using the patch in the generated application as my user count permits not beeing afraid of the synchronized block. Anyone else finding this issue can also apply the patch locally and help himself. "}}
{"actor":{"display_login":"bluegaspode"}}