Spring/spring-session
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Document that a custom CookieSerializer might break Remember Me

Browse Source 
Closes gh-2567
This commit is contained in:
Marcus Da Coregio
2023-10-26 13:29:55 -03:00
parent c97784a381
commit 72b65f41a9
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
spring-session-docs/modules/ROOT/pages/configuration/common.adoc
View File

@@ -60,6 +60,14 @@ If the regular expression matches, the first https://docs.oracle.com/javase/tuto
* `sameSite`: The value for the `SameSite` cookie directive.
To disable the serialization of the `SameSite` cookie directive, you may set this value to `null`.
Default: `Lax`
* `rememberMeRequestAttribute`: The request attribute name that indicates remember-me login.
If specified, the cookie will be written as `Integer.MAX_VALUE`.
[NOTE]
====
If you are using `SpringSessionRememberMeServices` and you are declaring a custom `DefaultCookieSerializer` bean, you should set the `rememberMeRequestAttribute` field to ensure that Spring Session relies on session expiration rather than cookie expiration.
To do so, you can use the following code snippet: `defaultCookieSerializer.setRememberMeRequestAttribute(SpringSessionRememberMeServices.REMEMBER_ME_LOGIN_ATTR);`
====
[[custom-cookie-in-webflux]]
=== Custom Cookie in WebFlux