anchor.diff:  @Configuration
   @EnableWebSecurity
   public class SecurityConfig {
  -
       @Bean
       SecurityFilterChain securityFilterChain(HttpSecurity http, RememberMeServices rememberMeServices) throws Exception {
           http
  
positive.code:                 );
          return http.build();
      }
  
      @Bean
      RememberMeServices rememberMeServices(UserDetailsService userDetailsService) {
          RememberMeTokenAlgorithm encodingAlgorithm = RememberMeTokenAlgorithm.SHA256;
          TokenBasedRememberMeServices rememberMe = new TokenBasedRememberMeServices(myKey, userDetailsService, encodingAlgorithm);
          rememberMe.setMatchingAlgorithm(RememberMeTokenAlgorithm.MD5);
          return rememberMe;
      }
  
  }
  ----
  
  .XML
  [source,xml,role="secondary"]
  ----
  <http>
    <remember-me services-ref="rememberMeServices"/>
  </http>
  
  <bean id="rememberMeServices" class=
  "org.springframework.security.web.authentication.rememberme.TokenBasedRememberMeServices">
      <property name="userDetailsService" ref="myUserDetailsService"/>
      <property name="key" value="springRocks"/>
      <property name="matchingAlgorithm" value="MD5"/>
      <property name="encodingAlgorithm" value="SHA256"/>
  </bean>
  ----
  ====
  
  At some point, you will want to fully migrate to Spring Security 6 defaults. But how do you know when it is safe to do so?
  Let's suppose that you deployed your application using SHA-256 as the encoding algorithm (as you have done <<servlet-opt-in-sha256-sha256-encoding,here>>) on November 1st, if you have the value for the `tokenValiditySeconds` property set to N days (14 is the default), you can migrate to SHA-256 N days after November 1st (which is November 15th in this example).
  By that time, all the tokens generated with MD5 will have expired.
  
  .Use Spring Security 6 defaults, SHA-256 for both encoding and matching
  ====
  .Java
  [source,java,role="primary"]
  
negative.code: @Configuration
  @EnableWebSecurity
  public class SecurityConfig {
      @Bean
      SecurityFilterChain securityFilterChain(HttpSecurity http, RememberMeServices rememberMeServices) throws Exception {
          http
  