[
https://issues.apache.org/jira/browse/WICKET-7193?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Emond Papegaaij resolved WICKET-7193.
-------------------------------------
Fix Version/s: 8.19.0
9.24.0
11.0.0
10.11.0
Resolution: Fixed
Removed in 11, deprecated in 8, 9 and 10.
> Deprecate and remove IAuthenticationStrategy
> --------------------------------------------
>
> Key: WICKET-7193
> URL: https://issues.apache.org/jira/browse/WICKET-7193
> Project: Wicket
> Issue Type: Task
> Affects Versions: 11.0.0, 9.23.0, 8.18.0, 10.10.0
> Reporter: Emond Papegaaij
> Assignee: Emond Papegaaij
> Priority: Major
> Fix For: 8.19.0, 9.24.0, 11.0.0, 10.11.0
>
>
> The interface IAuthenticationStrategy allows saving and loading credentials
> in a cookie. The only implementation DefaultAuthenticationStrategy does
> exactly this. Storing credentials in a cookie (encrypted or not) is a
> questionable practice and there is very little reason for wicket to support
> this out of the box. We should deprecate this interface in all supported
> wicket versions, stating that is retired for security reasons with no
> replacement. In 11 we can remove the interface and implementation and remove
> the 'Remember me' checkbox in SignInPanel in wicket-auth-roles.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
