Summary

This chapter explained and demonstrated the use of the remember-me feature in Spring Security. We started with the most basic setup and learned how to gradually make the feature more secure. Specifically, we learned about a token-based remember-me service and how to configure it. We also explore how persistent-based remember-me services can provide additional security, how they work, and the additional considerations necessary when using them.

We also covered the creation of a custom remember-me implementation that restricts the remember-me token to a specific IP address. We saw various other ways to make the remember-me feature more secure.

Up next is certificate-based authentication, and we will discuss how to use trusted client-side certificates to perform authentication.