Spring Security - Third Edition

Restricting the remember-me feature to an IP address

Let's put our understanding of the remember-me architecture to use. A common requirement is that any remember-me token should be tied to the IP address of the user that created it. This adds additional security to the remember-me feature. To do this, we only need to implement a custom PersistentTokenRepository interface. The configuration changes that we will make will illustrate how to configure a custom RememberMeServices. Throughout this section, we will take a look at IpAwarePersistentTokenRepository, which is included in the chapter's source code. The IpAwarePersistenTokenRepository interface ensures that the series identifier is internally combined with the current user's IP address, ...