Support For Reactive RememberMe Authentication

[ankurpathak]

I can't find the support for Reactive RemberMe Authentication based on Token and Persistence Store in
Reactive Web Security. For Persistence Remember Me we can use MongoDB instead of JDBC to keep
up the reactive means.

[ankurpathak]

@rwinch
This issue is very old. Is is on the list to be added? Or remember me authentication is now considered
a legacy thing by Spring Security Team? Atleash we can add the Plugin point for
it in AuthenticationFilter and let the comunity kick in to provide the rest of support. By Plugin point
I mean the same way as we have in AbstractAuthenticationProcessingFilter in case of Spring MVC.

[rwinch]

Sorry for the lack of response. With the ease of offloading sessions with things like Spring Session we generally just recommend using a longer session expiration and offloading the sessions into an external data store (i.e. Redis).

There is already a hook with the ServerAuthenticationSuccessHandler which can mark the session maxIdleTime to be an increased value. Does this meet your needs?

[ankurpathak]

@rwinch You mean to say that the whole mechanish of RememberMe Authentication was develoved
for automatic login when we was lacking projects like Spring Session, and sessions was just confined to single node. So we can simulate long sessions in such envirinments.

[rwinch]

Yes. There are some features you may need in regards to marking when the user authenticated so you can perhaps perform custom authorization logic based on the amount of time that the last authentication occurred

[ankurpathak]

Thanks Rob. I got your point.

[cbornet]

For smaller monolith apps, it is still useful to be able to store the session tokens into the main DB and not have to deploy another storage (Spring session doesn't support Mongo).

[ankurpathak]

For smaller monolith apps, it is still useful to be able to store the session tokens into the main DB and not have to deploy another storage (Spring session doesn't support Mongo).

@cbornet Spring Session support MongoDb. Plese check this project:
https://github.com/spring-projects/spring-session-data-mongodb

[spring-projects-issues]

If you would like us to look at this issue, please provide the requested information. If the information is not provided within the next 7 days this issue will be closed.

[wind57]

yeah, "supported". that MongoDB project last commit was 1.5 years ago (at the moment of this writing). Also look at how no one comments on issues over there, it's more a dead project than alive.