in src/main/java/org/apache/sling/auth/form/impl/FormAuthenticationHandler.java [432:457]
private void refreshAuthData(final HttpServletRequest request, final HttpServletResponse response,
final AuthenticationInfo authInfo) {
// get current authentication data, may be missing after first login
String authData = getCookieAuthData(authInfo);
// check whether we have to "store" or create the data
final boolean refreshCookie = needsRefresh(authData, this.sessionTimeout);
// add or refresh the stored auth hash
if (refreshCookie) {
long expires = System.currentTimeMillis() + this.sessionTimeout;
try {
authData = null;
authData = tokenStore.encode(expires, authInfo.getUser());
} catch (InvalidKeyException | IllegalStateException | NoSuchAlgorithmException e) {
log.error(e.getMessage(), e);
}
if (authData != null) {
authStorage.set(request, response, authData, authInfo);
} else {
authStorage.clear(request, response);
}
}
}