title: Remember me cookie decoding process
body: <p>I am using spring remember me services. I am seeing a strange behavior.</p>
  
  <p>Steps I am taking:</p>
  
  <ul>
  <li><p>login to my website using username /password and checking the remember me checkbox </p></li>
  <li><p>than I am closing the browser and opening a new browser and opening a new browser. Technically I must login automatically . This is also happening. I am using <code>PersistentTokenBasedRememberMeServices</code>.</p></li>
  <li><p>Now I close the browser again and opening a new browser again and when I try to access my website I am getting the following exception:</p>
  
  <pre><code>    SEVERE: Servlet.service() for servlet [appServlet] in context with path [/Spring-Security] threw exception org.springframework.security.web.authentication.rememberme.CookieTheftException: Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
      at org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices.processAutoLoginCookie(PersistentTokenBasedRememberMeServices.java:102)
      at org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices.autoLogin(AbstractRememberMeServices.java:115)
      at org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.doFilter(RememberMeAuthenticationFilter.java:97)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:54)
      at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:342)
      at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:45)
  </code></pre>
  
  <p>I drilled down more and i saw for my last two request the remember me token <code>SPRING_SECURITY_REMEMBER_ME_COOKIE</code> the value was </p>
  
  <p>bUpwUUJ3dGpUcVJjaGpIYXJxcmFkdz09OlBBRlZXbDVnYmZZQjM2RmFYVDNVMXc9PQ </p></li>
  </ul>
  
  <p>but spring decoded the (org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices.tokenRepository)</p>
  
  <pre><code>    final String presentedSeries = cookieTokens[0];
      final String presentedToken = cookieTokens[1];
  </code></pre>
  
  <p>correctly in first request but in second requested it decoded presentedToken  something different resulting in cookie theft exception .</p>
  
  <p>Is this the right behavior? How can I resolve the problem?</p>