Remember-Me

Remember-me keeps a user logged in across browser restarts with a long-lived cookie. It applies to session-based (form login) apps, not to JWT APIs.

CREATE TABLE persistent_logins (
    username  VARCHAR(64) NOT NULL,
    series    VARCHAR(64) PRIMARY KEY,
    token     VARCHAR(64) NOT NULL,
    last_used TIMESTAMP   NOT NULL
);

@Bean
PersistentTokenRepository persistentTokenRepository(DataSource dataSource) {
    JdbcTokenRepositoryImpl repo = new JdbcTokenRepositoryImpl();
    repo.setDataSource(dataSource);
    return repo;
}

@Bean
SecurityFilterChain web(HttpSecurity http, PersistentTokenRepository tokens,
                        UserDetailsService users) throws Exception {
    http
        .authorizeHttpRequests(auth -> auth
            .requestMatchers("/seller/payouts/**").fullyAuthenticated()   // re-login required
            .requestMatchers("/seller/**").hasRole("SELLER")
            .anyRequest().permitAll())
        .formLogin(Customizer.withDefaults())
        .rememberMe(rm -> rm
            .tokenRepository(tokens)
            .userDetailsService(users)
            .tokenValiditySeconds((int) Duration.ofDays(14).toSeconds())
            .rememberMeParameter("remember-me"))                       // checkbox name on the form
        .logout(logout -> logout.deleteCookies("JSESSIONID", "remember-me"));
    return http.build();
}