From d68a61e5b5281363e75fdacfa9170e2b8e378f73 Mon Sep 17 00:00:00 2001
From: Volodymyr Borysenko <borysoff21@gmail.com>
Date: Sun, 8 Nov 2026 01:41:40 -0800
Subject: [PATCH] Return the sealed token from setRememberToken without
 password

The 5 argument setRememberToken set the cookie but returned an empty
string. It now returns the sealed token like the deprecated overload.
The test now checks the returned value against the cookie.

Closes #928
---
 .../org/owasp/esapi/reference/DefaultHTTPUtilities.java    | 5 +----
 .../java/org/owasp/esapi/reference/HTTPUtilitiesTest.java  | 7 +++++--
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java b/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
index 2dabec23c..b7f82a077 100644
--- a/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
+++ b/src/main/java/org/owasp/esapi/reference/DefaultHTTPUtilities.java
@@ -1016,7 +1016,6 @@ public String setRememberToken( HttpServletRequest request, HttpServletResponse
 
 
     public String setRememberToken(HttpServletRequest request, HttpServletResponse response, int maxAge, String domain, String path){
-        String rval = "";
         User user = ESAPI.authenticator().getCurrentUser();
 
         try{
@@ -1039,13 +1038,11 @@ public String setRememberToken(HttpServletRequest request, HttpServletResponse r
             cookie.setSecure(forceSecureCookies);
             response.addCookie( cookie );
             logger.info(Logger.SECURITY_SUCCESS, "Enabled remember me token for " + user.getAccountName() );
+            return cryptToken;
         } catch( IntegrityException e){
             logger.warning(Logger.SECURITY_FAILURE, "Attempt to set remember me token failed for " + user.getAccountName(), e );
             return null;
         }
-
-
-        return rval;
     }
 
     /**
diff --git a/src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java b/src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java
index 2b164dbd9..015cc1d42 100644
--- a/src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java
+++ b/src/test/java/org/owasp/esapi/reference/HTTPUtilitiesTest.java
@@ -643,20 +643,23 @@ public void testSetRememberToken() throws Exception {
 
         int maxAge = ( 60 * 60 * 24 * 14 );
 
-        ESAPI.httpUtilities().setRememberToken( request, response, maxAge, "domain", "/" );
+        String token = ESAPI.httpUtilities().setRememberToken( request, response, maxAge, "domain", "/" );
 
         Field field = response.getClass().getDeclaredField("cookies");
         field.setAccessible(true);
         @SuppressWarnings("unchecked")
         List<Cookie> cookies = (List<Cookie>) field.get(response);
+        // The first cookie with this name is the one killCookie() adds, so keep the last one.
         Cookie cookie = null;
         for(Cookie c: cookies){
             if(c.getName().equals(HTTPUtilities.REMEMBER_TOKEN_COOKIE_NAME)){
                 cookie = c;
-                break;
             }
         }
         assertEquals(HTTPUtilities.REMEMBER_TOKEN_COOKIE_NAME, cookie.getName());
+        assertNotNull(token);
+        assertFalse(token.isEmpty());
+        assertEquals(cookie.getValue(), token);
     }
 
     public void testGetSessionAttribute() throws Exception {