Package org.springframework.security.core.token

Interface TokenService

All Known Implementing Classes:
KeyBasedPersistenceTokenService
public interface TokenService
Provides a mechanism to allocate and rebuild secure, randomised tokens.

Implementations are solely concern with issuing a new Token on demand. The issued Token may contain user-specified extended information. The token also contains a cryptographically strong, byte array-based key. This permits the token to be used to identify a user session, if desired. The key can subsequently be re-presented to the TokenService for verification and reconstruction of a Token equal to the original Token.

Given the tightly-focused behaviour provided by this interface, it can serve as a building block for more sophisticated token-based solutions. For example, authentication systems that depend on stateless session keys. These could, for instance, place the username inside the user-specified extended information associated with the key). It is important to recognise that we do not intend for this interface to be expanded to provide such capabilities directly.

Since:
2.0.1

  • Method Summary

    Modifier and Type
    Method
    Description
    Token
    allocateToken(String extendedInformation)
    Forces the allocation of a new Token.
    Token
    verifyToken(String key)
    Permits verification the Token.getKey() was issued by this TokenService and reconstructs the corresponding Token.

  • Method Details

    • allocateToken

      Token allocateToken(String extendedInformation)
      Forces the allocation of a new Token.
      Parameters:
      extendedInformation - the extended information desired in the token (cannot be null, but can be empty)
      Returns:
      a new token that has not been issued previously, and is guaranteed to be recognised by this implementation's verifyToken(String) at any future time.

    • verifyToken

      Token verifyToken(String key)
      Permits verification the Token.getKey() was issued by this TokenService and reconstructs the corresponding Token.
      Parameters:
      key - as obtained from Token.getKey() and created by this implementation
      Returns:
      the token, or null if the token was not issued by this TokenService