Spring Security - Third Edition

Remember-me signature

We can see how MD5 can ensure that we have downloaded the correct file, but how does this apply to Spring Security's remember-me service? Much like the file we downloaded, the cookie is untrusted, but we can trust it if we can validate the signature that originated from our application. When a request comes in with the remember-me cookie, its contents are extracted and the expected signature is compared to the signature found in the cookie. The steps in calculating the expected signature are illustrated in the following diagram:

The remember-me cookie contains the username, expiration, and a signature. Spring Security ...