Spring Security - Third Edition

Token-based remember-me configuration directives

The following two configuration changes are commonly made to alter the default behavior of the remember-me functionality:

Attribute	Description
key	Defines a unique key used when producing the remember-me cookie's signature.
tokenValiditySeconds	Defines the length of time (in seconds). The remember-me cookie will be considered valid for authentication. It is also used to set the cookie expiration timestamp.

 

As you may infer from the discussion of how the cookie contents are hashed, the key attribute is critical for the security of the remember-me feature. Make sure that the key you choose is likely to be unique to your application and long enough so that it can't be ...