Justin Koke added a comment - 16/Apr/2009 2:16 AM Crowd currently has no way to determine if an authentication request came from a seraph cookie or just the login form of an app. All that seraph is doing is 'de-crypting' the username and password from the users cookie and passing this onto Crowd via the standard auth request. Perhaps we could log a debug call in our JIRA and Confluence seraph code that we are about to send an auth request to Crowd that is via the remember-me password. Actually we already do this! /** * Attempts to authenticate the request based on the auto-login cookie ( if set). * This will only authenticate to Crowd via HttpAuthenticator. This will not set * any session variables and the like. * * @param request servlet request. * @param response servlet response. * @ return true if authentication via HttpAuthenticator using auto-login credentials successful. */ protected boolean autoLoginToCrowd(HttpServletRequest request, HttpServletResponse response) { Cookie cookie = CookieFactory.getCookieHandler().getCookie(request, getLoginCookieKey()); if (cookie == null ) { return false ; } String [] values = decodeCookie(cookie.getValue()); if (ArrayUtils.isEmpty(values)) { return false ; } String username = values[0]; String password = values[1]; logger.debug( "Got username and password from auto-login cookie, attempting to authenticate user" ); // perform login (note: we cant call login as login first checks isAuthenticated, which would call this method, resulting in a loop) try { httpAuthenticator.authenticate(request, response, username, password); logger.debug( "User authenticated via auto-login cookie" ); return true ; } catch (Exception e) { logger.debug( "Could not auto-login authenticate user " + username, e); if (response != null ) { // remove all auto-login information CookieFactory.getCookieHandler().invalidateCookie(request, response, getLoginCookieKey(), "/" ); } return false ; } } Justin