java - JSESSIONID not expired, SPRING_SECURITY_REMEMBER_ME expired -
java - JSESSIONID not expired, SPRING_SECURITY_REMEMBER_ME expired -
so, have in application spring security , have introduced remember me functionality when checkbox checked in.
i wanted know exact behavior: if set </remember-me>
tag , specify remembermeservices
tokenvalidityseconds
20
seconds, shouldn't session expire , and inquire me log in again? have set:
<session-config> <session-timeout>xx</session-timeout> </session-config>
so matches spring_security_remember_me
cookie tokenvalidityseconds
?
update
does matter if i've implemented own persistenttokenbasedremembermeservices
? had override default persistenttokenbasedremembermeservices
coming spring, because persistentremembermetoken
did not have no-arg constructor, unable utilize hibernate that, did wrote own persistentremembermetoken
, persistenttokenbasedremembermeservices
(which, way, no have special beside me introducing no-arg constructor in persistentremembermetoken
, beside that, it's re-create paste spring's source)
having remember-me token valid less session-timeout have no effect on authentication during session, if that's asking.
once authenticated during session, authentication valid duration of session, unless log out or session expires.
the remember-me token considered if unauthenticated, otherwise ignored.
java spring-security session-cookies
Comments
Post a Comment