Spring Security - Third Edition

Is remember-me secure?

Any feature related to security that has been added for user convenience has the potential to expose our carefully-protected site to a security risk. The remember-me feature, in its default form, runs the risk of the user's cookie being intercepted and reused by a malicious user. The following diagram illustrates how this might happen:

The use of SSL (covered in the Appendix, Additional Reference Material) and other network security techniques can mitigate this type of attack, but be aware that there are other techniques, such as cross-site scripting (XSS), that can steal or compromise a remembered user session. While ...