Package com.codename1.backend.security.rememberme

package com.codename1.backend.security.rememberme

Remember-me: recognizing a returning user by a cookie, so that closing the browser does not sign them out.

http.rememberMe(...) turns it on for a chain. The cookie holds a series and a token, of which the server keeps only a hash; the token is replaced every time the cookie is used, and a cookie whose series is known but whose token is not is taken as stolen, which signs the user out everywhere. Tokens are kept by a PersistentTokenRepository: in memory, or in the server's database.

A user recognized this way is authenticated but not fully: see RememberMeAuthenticationToken.

Related Packages

Package	Description
com.codename1.backend.security	Authentication and authorization for the routes of a backend, in the shape of Spring Security: an application declares one or more SecurityFilterChain beans, each built from the HttpSecurity its method is handed, and every request the server does not answer on its own behalf is put to them.
com.codename1.backend.security.apikey	API keys: long-lived secrets a program presents instead of signing in.
com.codename1.backend.security.crypto	Password hashing: the PasswordEncoder contract, the delegating encoder that reads the {id} in front of a stored password, and the encoders behind it.
com.codename1.backend.security.mfa	A second factor at sign-in: one-time codes from an authenticator app, and the recovery codes that stand in for a lost phone.
com.codename1.backend.security.ratelimit	Limits on how often a client may ask: a RateLimiter counts requests under a key, and a RateLimitKeyResolver says which key a request counts under -- its client's address, who it is signed in as, its session, its API key.
com.codename1.backend.security.webauthn	Passkeys: signing in with a credential an authenticator holds, as the Web Authentication specification defines it.

Class	Description
InMemoryTokenRepositoryImpl	Remembered sign-ins kept in this process: gone when it stops, and unknown to any other process of the same deployment.
JdbcTokenRepository	Remembered sign-ins kept in the server's database, in the cn1_persistent_logins table of SecuritySchema, so that any process of a deployment recognizes a cookie any other issued.
PersistentRememberMeToken	One remembered sign-in, as the server keeps it: whose it is, the series the cookie names, the hash of the token the cookie must carry next, and when it was last used.
PersistentTokenBasedRememberMeServices	Remember-me with a series and a rotating token.
PersistentTokenRepository	Where remembered sign-ins are kept.
RememberMeServices	What remembers a user between sessions: issues the cookie at sign-in, and recognizes it on a request nobody has signed in for.