Stateful CookieAuthentication, problem with SecuredAction

Hi, I am try to use stateful cookie authenticator. I use play 2.5, silhouette 4.0, mysql, slick.

My configs:

silhouette {
  authenticator {
    cookie {
      cookieName = "cookie_authenticator"
      cookiePath = "/"
      secureCookie = false
      httpOnlyCookie = true
      useFingerprinting = true
      cookieMaxAge = 30 minutes
      authenticatorIdleTimeout = 30 minutes
      authenticatorExpiry = 12 hours
    signer.key = "[changeme]"
    crypter.key = "[changeme]"
class SilhouetteModule extends AbstractModule with ScalaModule {

  def configure() {


    bind[IDGenerator].toInstance(new SecureRandomIDGenerator())
    bind[PasswordHasher].toInstance(new BCryptPasswordHasher)
    bind[FingerprintGenerator].toInstance(new DefaultFingerprintGenerator(false))

  def provideHTTPLayer(client: WSClient): HTTPLayer = new PlayHTTPLayer(client)

  //-------------- Environments -------------

  def provideRecoveryEnvironment(
    userService: UserService,
    authenticatorService: AuthenticatorService[CookieAuthenticator],
    eventBus: EventBus
  ): Environment[MyEnvironment] = {


  //-------------- Providers -------------

  def provideCredentialsProvider(
    authInfoRepository: AuthInfoRepository,
    passwordHasherRegistry: PasswordHasherRegistry
  ): CredentialsProvider = {
    new CredentialsProvider(authInfoRepository, passwordHasherRegistry)

  //-------------- Authenticator Services -------------

  def provideCookieAuthenticatorService(
    @Named("authenticator-cookie-signer") cookieSigner: CookieSigner,
    @Named("authenticator-crypter") crypter: Crypter,
    fingerprintGenerator: FingerprintGenerator,
    idGenerator: IDGenerator,
    configuration: Configuration,
    authenticatorRepository: AuthenticatorRepository[CookieAuthenticator],
    clock: Clock): AuthenticatorService[CookieAuthenticator] = {
    val config =[CookieAuthenticatorSettings]("silhouette.authenticator.cookie")
    val encoder = new CrypterAuthenticatorEncoder(crypter)
    new CookieAuthenticatorService(config, Some(authenticatorRepository), cookieSigner, encoder, fingerprintGenerator, idGenerator, clock)


  def provideAuthenticatorCrypter(configuration: Configuration): Crypter = {
    val config =[JcaCrypterSettings]("silhouette.authenticator.crypter")
    new JcaCrypter(config)

  def provideCookieSigner(configuration: Configuration): CookieSigner = {
    val config =[JcaCookieSignerSettings]("silhouette.authenticator.jcasigner")
    new JcaCookieSigner(config)

  def providePasswordHasherRegistry(passwordHasher: PasswordHasher): PasswordHasherRegistry = {

  @Provides @Named("authenticator-cookie-signer")
  def provideAuthenticatorCookieSigner(configuration: Configuration): CookieSigner = {
    val config =[JcaCookieSignerSettings]("silhouette.authenticator.signer")
    new JcaCookieSigner(config)

trait MyEnvironment extends Env {
  type I = User
  type A = CookieAuthenticator

**// qCookieAuthenticators - TableQuery for store, retrieve, update, delete authenticator data**

class CookieAuthenticatorDao @Inject() (dbConfigProvider: DatabaseConfigProvider)
  extends AuthenticatorRepository[CookieAuthenticator] {
  lazy val dbConfig: DatabaseConfig[JdbcProfile] = dbConfigProvider.get[JdbcProfile]
  def find(id: String): Future[Option[CookieAuthenticator]] = {{
      case Some(elem) => Some(elem)
      case _ => None
  def add(authenticator: CookieAuthenticator): Future[CookieAuthenticator] = { += authenticator).map(_ => authenticator)
  def update(authenticator: CookieAuthenticator): Future[CookieAuthenticator] = => authenticator)
  def remove(id: String): Future[Unit] = => Unit)
//    User extends Identity

trait UserService extends IdentityService[User] {
  def save(user: User): Future[User]
  def update(user: User): Future[User]

Implementation for UserService

class UserServiceImpl @Inject() (userDAO: UserDao) extends UserService {
  def retrieve(loginInfo: LoginInfo): Future[Option[User]] = userDAO.find(loginInfo)
  def save(user: User): Future[User] =
  def update(user: User): Future[User] = userDAO.update(user)

So, when I access SecuredAction, silhouette retrieve CookieAuthenticator from data base it’s ok, but after that dont retrieve User by loginInfo he not invoke UserService. Without SecuredAction, using UserAwareAction I can get CookieAuthenticator ID but I think is not correct

class ApplicationController @Inject() (
  val messagesApi: MessagesApi,
  silhouette: Silhouette[MyEnvironment]
  extends Controller with I18nSupport {
  def user: Action[AnyContent] = silhouette.SecuredAction.async { implicit request =>

As I understood silhouette inject auth data in request using SecuredRequestHandlerBuilder

  override def invokeBlock[B, T](block: SecuredRequest[E, B] => Future[HandlerResult[T]])(implicit request: Request[B]): Future[HandlerResult[T]] = {
    withAuthorization(handleAuthentication).flatMap {
      // A user is both authenticated and authorized. The request will be granted
      case (Some(authenticator), Some(identity), Some(authorized)) if authorized =>
        environment.eventBus.publish(AuthenticatedEvent(identity, request))
        handleBlock(authenticator, a => block(SecuredRequest(identity, a, request)))
      // A user is authenticated but not authorized. The request will be forbidden
      case (Some(authenticator), Some(identity), _) =>
        environment.eventBus.publish(NotAuthorizedEvent(identity, request))
        handleBlock(authenticator, _ => => HandlerResult(r)))
      // An authenticator but no user was found. The request will ask for authentication and the authenticator will be discarded
      case (Some(authenticator), None, _) =>
        for {
          result <- errorHandler.onNotAuthenticated
          discardedResult <- environment.authenticatorService.discard(authenticator.extract, result)
        } yield HandlerResult(discardedResult)
      // No authenticator and no user was found. The request will ask for authentication
      case _ =>
        environment.eventBus.publish(NotAuthenticatedEvent(request)) => HandlerResult(r))

// handleAuthentication block

protected def handleAuthentication[B](implicit request: Request[B]): Future[(Option[Either[E#A, E#A]], Option[E#I])] = {
   environment.authenticatorService.retrieve.flatMap {
      // A valid authenticator was found so we retrieve also the identity
      //                      get here, but not invoke environment.identityService.retrieve(a.loginInfo).map(i => Some(Left(a)) -> i)
      //                      a.isValid get True by configs from silhouette.conf
      case Some(a) if a.isValid  => environment.identityService.retrieve(a.loginInfo).map(i => Some(Left(a)) -> i)
      // An invalid authenticator was found so we needn't retrieve the identity
      case Some(a) if !a.isValid => Future.successful(Some(Left(a)) -> None)
      // No authenticator was found so we try to authenticate with a request provider
      case None => handleRequestProviderAuthentication.flatMap {
        // Authentication was successful, so we retrieve the identity and create a new authenticator for it
        case Some(loginInfo) => environment.identityService.retrieve(loginInfo).flatMap { i =>
          environment.authenticatorService.create(loginInfo).map(a => Some(Right(a)) -> i)
        // No identity and no authenticator was found
        case None => Future.successful(None -> None)

I think problem in Environment[MyEnvironment] initialization when we use stateful CookieAuthenticator.

I tried to change from CookieAtuhenticator to JWTAuthenticator and it’s ok works well with same configs with little changes in dao and added service for JWT, but I need CookieAuthenticator for web client.

Please help.

###Thank you


have you tried to turn on logging? The cookie authenticator DAO returns the authenticator from database? The returned authenticator contains a LoginInfo for which a user is stored? The authenticator is valid and not expired? The validity of the authenticator will be checked after the token was retrieved from the database. The fingerprints are the same? Maybe you disable fingerprinting for testing.

Best regards,

"The fingerprints are the same?"
this is my problem, thank you, excuse me for disturbing. Silhouette ROCK :smiley: