jvoisin 3e07ea5288 Use a random key to "encrypt" the remember-me cookie's value ...

Since Spring's default remember-me technique is
terrible security-wise (`user:timstamp:md5(use:timestamp:password:key)`),
we should at least use a random key, instead of a fixed one,
otherwise, and attacker able to capture the cookies
might be able to trivially bruteforce offline
the password of the associated user.

2019-04-01 11:33:35 +02:00

..

src

Use a random key to "encrypt" the remember-me cookie's value

2019-04-01 11:33:35 +02:00

cve-suppressed.xml

Exclude new spring 5.0.5 cve

2019-03-27 19:00:14 -06:00

pom.xml

Fix StringIndexOutOfBounds errors thrown by DWR/YUI

2019-03-28 22:08:26 +01:00