The remember-me architecture

We have gone over the basic architecture of both TokenBasedRememberMeServices and PersistentTokenBasedRememberMeServices, but we have not described the overall architecture. Let's see how all of the remember-me pieces fit together.

The following diagram illustrates the different components involved in the process of validating a token-based remember-me token:

As with any of the Spring Security filters, RememberMeAuthenticationFilter is invoked from within FilterChainProxy. The job of RememberMeAuthenticationFilter is to inspect the request, and if it is of interest, an action is taken. The RememberMeAuthenticationFilter interface will use the RememberMeServices implementation to determine if the user is already logged in. The RememberMeServices interface does this by inspecting the HTTP request for a remember-me cookie that is then validated...