title: Spring Security: CookieTheftException with PersistentTokenBasedRememberMeServices
body: <p>I have a web application with spring-boot 2.0.1 protected by spring-security. I use a <code>PersistentTokenRepository</code> for Remember-Me and store the tokens in a MySQL database.</p>
  
  <p>In the server logfiles I see quite a lot of stacktraces with <code>CookieTheftException</code>s. It's so many that I find it hard to believe that actual Cookies are stolen but assume some kind of misconfiguration. From adding some analyzing code, it seems only mobile browsers are affected.</p>
  
  <pre><code>Servlet.service() for servlet [dispatcherServlet] in context with path [/r] threw exception
    org.springframework.security.web.authentication.rememberme.CookieTheftException: Invalid remember-me token (Series/token) mismatch. Implies previous cookie theft attack.
      at org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices.processAutoLoginCookie(PersistentTokenBasedRememberMeServices.java:119) ~[spring-security-web-5.0.4.RELEASE.jar!/:5.0.4.RELEASE]
  </code></pre>
  
  <p>Manual testing was not able to reproduce this. Deleting the session cookie, but keeping the remember-me Cookie and making a request to a restricted URL leads to a normal authenticated session.</p>
  
  <p>Here are the relevant parts of my security configuration:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(prePostEnabled = true)
  public class WebSecurityConfig {
      @Configuration
      public static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
  
          @Autowired
          private RememberMeServices rememberMeServices;
  
          @Override
          protected void configure(HttpSecurity http) throws Exception {
              http
                      .rememberMe()
                      .key(rememberMeKey)
                      .rememberMeServices(rememberMeServices);
              ;
          }
      }
  
      /**
       * Key for RememberMeServices and RememberMeAuthenticationProvider.
       */
      private static final String rememberMeKey = "...";
  
      @Bean
      public RememberMeServices rememberMeServices(UserDetailsService userDetailsService, PersistentTokenRepository persistentTokenRepository) {
          PersistentTokenBasedRememberMeServices rememberMeServices = new AnalyzingPersistentTokenBasedRememberMeServices(
                  rememberMeKey, userDetailsService, persistentTokenRepository);
          rememberMeServices.setTokenValiditySeconds((int) Duration.of(366L, ChronoUnit.DAYS).toSeconds());
          return rememberMeServices;
      }
  
      @Bean
      public PersistentTokenRepository persistentTokenRepository(JdbcTemplate jdbcTemplate) {
          JdbcTokenRepositoryImpl tokenRepository = new JdbcTokenRepositoryImpl();
          tokenRepository.setJdbcTemplate(jdbcTemplate);
          return tokenRepository;
      }
  }
  </code></pre>
  
  <p>That <code>AnalyzingPersistentTokenBasedRememberMeServices</code> is a <code>PersistentTokenBasedRememberMeServices</code> with some additional logging in <code>processAutoLoginCookie</code>.</p>
  
  <p>Another speciality is, that I use a custom <code>AuthenticationProvider</code>, and provide a <code>UserDetailsService</code> only for RememberMe. But as said above, manual testing works just fine. Still, users report they get logged out too often (session timeout is 24 hours).</p>
  
  <p>Did anybody experience something like this and has a solution? Do I miss some crucial configuration?</p>