Spring Security - Third Edition

How does the persistent-based remember-me feature work?

Instead of validating a signature present in the cookie, the persistent-based remember-me service validates if the token exists in a database. Each persistent remember-me cookie consists of the following:

• Series identifier: This identifies the initial login of a user and remains consistent each time the user is automatically logged in to the original session
• Token value: A unique value that changes each time a user is authenticated using the remember-me feature

Take a look at the following diagram:

When the remember-me cookie is submitted, Spring Security will use an o.s.s.web.authentication.rememberme.PersistentTokenRepository ...