Implementing remember me without a key

i fou开发者_JS百科nd some samples that implements remember me functionality by just

<remember-me/>

and other samples implement it as:

<remember-me key="_spring_security_remember_me"/>

and i want to know what is the difference between the two declarations, and is the _spring_security_remember_me is a predefined key? thanks.

---

The default key can be found in AuthenticationConfigBuilder.createRememberMeFilter()

    final String DEF_KEY = "SpringSecured";

That is the value that is used if you don't specify one in <remember-me>

---

From the documentation, the key attribute is used in hashing the value stored in the cookie. It prevents a malicious user from trying to decode the cookie, because they can't do that (well it s a lot harder) without the key.

---

For anyone looking for the rememberme().key() feature in the future, it seems that as of Spring Boot 2.2.6 there is SecureRandom generator to generate the key if it is not provided. Here is the implementation found in org.springframework.security.config.http.AuthenticationConfigBuilder.createRememberMeFilter

private String createKey() {
    SecureRandom random = new SecureRandom();
    return Long.toString(random.nextLong());
}