title: Why is remember-me a lesser authentication then full-authentication in spring-security?
body: <p>This is a conceptual question about the fact, that authentication has different grades in spring security.</p>
  <p>There is a grade for</p>
  <ol>
  <li><a href="https://docs.spring.io/spring-security/site/docs/current/reference/html5/#anonymous" rel="nofollow noreferrer">anonymous authentication</a> also called <code>IS_AUTHENTICATED_ANONYMOUSLY</code></li>
  <li>and <a href="https://docs.spring.io/spring-security/site/docs/current/reference/html5/#servlet-rememberme" rel="nofollow noreferrer">remember me authentication</a> <code>IS_AUTHENTICATED_REMEMBERED</code></li>
  <li>the full authentication, when a user just provided his entire credentials and got confirmed aka <code>IS_AUTHENTICATED_FULLY</code></li>
  </ol>
  <p>In the implementation of <code>AuthenticatedVoter#isFullyAuthenticated</code> it is clear, that a full authenticated user cannot be <code>anonymous authenticated</code> or <code>remember-me authenticated</code>.</p>
  <p>While I fully understand why we differentiate between <code>IS_AUTHENTICATED_FULLY</code> and <code>IS_AUTHENTICATED_ANONYMOUSLY</code>, I really do not understand why <code>IS_AUTHENTICATED_REMEMBERED</code> is not treated equally to <code>IS_AUTHENTICATED_FULLY</code>.</p>
  <h1>How I understand remember me:</h1>
  <p>I understand remember me as authentication using some kind of secret token - using this token we load an existing <code>SecurityContext</code> which already includes the fully authenticated <code>Authentication</code> object written there during the initial <code>full authentication</code>. It is basically restored full authentication in this regard.</p>
  <p>Comparing this to the session-login, which has a similar token but considered full-authentication in spring security, why is there a difference between remember-me and session-based?</p>
  <h1>Question:</h1>
  <p>Considering that remember-me restored a full-authenticated <code>SecurityContext</code>, the application logic would treat the context the same as it would be just normal full authentication.</p>
  <p>If we would have some logic for full authenticated users in the application, it would surely also apply to remeber-me authenticated cases.</p>
  <p>Of course, for <code>anonymous authenticated</code> users we often have different decisions to take, so that is why I understand why this is singled out.</p>
  <p>Do I understand the concept of remember-me the wrong way or what is the exact reason not counting users <code>remembered</code> as fully authenticated?</p>