anchor.diff:                  );
           return http.build();
       }
  -
       @Bean
       RememberMeServices rememberMeServices(UserDetailsService userDetailsService) {
           RememberMeTokenAlgorithm encodingAlgorithm = RememberMeTokenAlgorithm.SHA256;
           TokenBasedRememberMeServices rememberMe = new TokenBasedRememberMeServices(myKey, userDetailsService, encodingAlgorithm);
  -        rememberMe.setMatchingAlgorithm(RememberMeTokenAlgorithm.MD5);
  +        rememberMe.setMatchingAlgorithm(RememberMeTokenAlgorithm.SHA256);
           return rememberMe;
       }
  -
   }
   ----
  -
   .XML
   [source,xml,role="secondary"]
   ----
   <http>
     <remember-me services-ref="rememberMeServices"/>
   </http>
  -
   <bean id="rememberMeServices" class=
   "org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
       <property name="userDetailsService" ref="myUserDetailsService"/>
       <property name="key" value="springRocks"/>
  -    <property name="matchingAlgorithm" value="MD5"/>
  +    <property name="matchingAlgorithm" value="SHA256"/>
       <property name="encodingAlgorithm" value="SHA256"/>
   </bean>
   ----
   ====
   
  -At some point, you will want to fully migrate to Spring Security 6 defaults. But how do you know when it is safe to do so?
  -Let's suppose that you deployed your application using SHA-256 as the encoding algorithm (as you have done <<servlet-opt-in-sha256-sha256-encoding,here>>) on November 1st, if you have the value for the `tokenValiditySeconds` property set to N days (14 is the default), you can migrate to SHA-256 N days after November 1st (which is November 15th in this example).
  -By that time, all the tokens generated with MD5 will have expired.
  -
  -.Use Spring Security 6 defaults, SHA-256 for both encoding and matching
  +then the defaults can be removed:
  +
   ====
   .Java
   [source,java,role="primary"]
  
positive.code: @Configuration
  @EnableWebSecurity
  public class SecurityConfig {
  
      @Bean
      SecurityFilterChain securityFilterChain(HttpSecurity http, RememberMeServices rememberMeServices) throws Exception {
          http
  
negative.code:                 );
          return http.build();
      }
      @Bean
      RememberMeServices rememberMeServices(UserDetailsService userDetailsService) {
          return new TokenBasedRememberMeServices(myKey, userDetailsService);
      }
  }
  ----
  .XML
  [source,xml,role="secondary"]
  ----
  <http>
    <remember-me services-ref="rememberMeServices"/>
  </http>
  <bean id="rememberMeServices" class=
  "org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
      <property name="userDetailsService" ref="myUserDetailsService"/>
      <property name="key" value="springRocks"/>
  </bean>
  ----
  ====
  