playframework/play — pull request #469 by Michael-S (2012-02-24 17:47:12+00:00)
Title: [#599] Change the Secure Module so that the expiration date is signed

Up until now, the Secure Module's persistent login cookie named "rememberme" signs the username only. If the cookie is captured in any way, an attacker can use it to log in as that user until that username is changed or the application secret key is changed. With this patch the "rememberme" cookie now signs the username and the expiration date of the login, so that a captured cookie is only valid until the original expiration date.