Remember-me feature

[jgrodziski]

Hi,

I've just implemented a remember-me feature for Friend, it's rough on the edge but the main parts are there. Could you comment about the implementation and improvements?
Thanks.

Jérémie.

Here are some notes about the implementation

Issuing a remember-me Cookie at login

• The interactive-form workflow retrieve the remember-me form parameters.
• The workflow function verifies the supplied credentials (username/password) with the bcrypt-credential-fn (through the login config),
  • if the form parameters remember-me is set to "true" then
    • the bcrypt-credential-fn invoke the credentials/remember-me function that issue new remember-me data (not the cookie yet) that will be returned through the authenticate response.
    • The remember-me function is given a save-remember-me-fn! as a first parameters to allow the persistent storage of the issued data. The save-remember-me-fn! is defined with the login config.
• If any remember-me data is present in the interactive-login workflow response then it is encoded into a persistent cookie in the friend/authenticate* function with the friend/set-cookies-if-any function.

Authenticate with a remember-me cookie

Once issued and sent to the client, each subsequent http request will include the persistent remember-me cookie.

• The workflow/remember-me-hash function workflow test if a remember-me cookie is present in the request.
  • It verifies the validity of the cookie with the credentials/remember-me-hash-fn that loads the stored remember-me data and then compare with the data provided in the cookie (validity, expiration, etc.), otherwise it returns nil and the make-auth fn does not make it.
  • The workflow/remember-me-hash then make-auth and transmit the authenticated request to the subsequent handler

Testing

There is a dedicated test functional/user-login-with-remember-me-cookie-set.

[jgrodziski]

BTW, the remember-me token is an hash one (easier for a first implementation). I know there is a better way with a triplet (username, serie and token), but once that first version is validated, the triplet version could be easily implemented as an alternative.

[jgrodziski]

Another "reference" article about remember-me implementation.