title: Spring security authentication management vulnerability
body: <p>Spring documentation says that remember me is implemented by storing following information in cookie - </p>
  
  <blockquote>
    <p>base64(username + ":" + expirationTime + ":" + md5Hex(username + ":" +
    expirationTime + ":" password + ":" + key))</p>
  </blockquote>
  
  <p>I have following confusions - </p>
  
  <ol>
  <li><p>Why use an unsecure hash like MD5 to digest the information instead of using SHA-1 or SHA-2. Would the performance hit from these be significant for such a small piece of information?</p></li>
  <li><p>Why transmit this information over the network at all? Why not maintain a map of cryptographically secure random number and this info on the server, returning only the map key as a cookie. AFAIK this is the approach used by Servlet API and is deemed more secure.</p></li>
  </ol>