CODEWITHSUNDEEP
javaspringspring-mvcspring-security
dalcu
dalcu

Reputation: 263

Spring-boot security remember-me token not working

For some reason I cannot get Spring-Security to work with remember-me. It never creates the cookie on the client side.

Here is my login form

<input type="checkbox" name="_spring_security_remember_me"/> Remember me

also tried

<input type="checkbox" name="remember-me"/> Remember me

Here is my SecuritySettings

        http.authorizeRequests()
        ......
        .anyRequest().fullyAuthenticated()
        .and()
            .formLogin().loginPage("/login").failureUrl("/login?error").permitAll()
        .and()
            .logout().logoutRequestMatcher(new AntPathRequestMatcher("/logout")).logoutSuccessUrl("/login")
        .and()
            .rememberMe()
            .tokenValiditySeconds(31536000);

I tried both my own custom form, and the built in Spring login form.. none work for remember me.

The way I tested is, login, copy secured url, close browser, open browser and paste url.

Upvotes: 3

Views: 3747

Answers (1)

Babl
Babl

Reputation: 7646

This is as simple as changing fullyAuthenticated() to authenticated().

As in javadocs for fullyAuthenticated() it is said :

Specify that URLs are allowed by users who have authenticated and were not "remembered".

Upvotes: 5

Related Questions