Spring Security session management and remember me tutorial — Complete Guide

A practical, in-depth guide to Spring Security session management and remember me tutorial with examples.

INTRO

Every production‑grade Spring Boot app eventually hits the “session” wall. You might have started with a simple form login, but as traffic grows you’ll notice users getting logged out unexpectedly, concurrent logins being abused, or, worse, session fixation attacks slipping through the cracks. The default Spring Security configuration protects you against the most obvious threats, yet it leaves critical knobs untouched: session concurrency limits, custom session expiration policies, and the infamous “remember‑me” cookie that can become a backdoor if mis‑configured.

Ignoring these knobs isn’t just a theoretical risk. Real‑world incidents—like users being forced off a shared workstation because another device silently hijacked their session—are often traced back to lax session management. Meanwhile, developers love the convenience of “keep me logged in” but end up storing plain tokens or using the default 2‑week cookie without any persistence strategy, opening the door to replay attacks. The right balance between security and usability requires a deliberate, code‑first approach, and that’s exactly what the full guide walks you through.

In this teaser, I’ll highlight why you should care about session fixation, concurrency control, and a robust remember‑me implementation before you ship your next microservice or monolith. The goal isn’t to replace Spring Security’s defaults but to extend them with production‑ready patterns that keep users safe without sacrificing the smooth “stay signed in” experience they expect.

WHAT YOU'LL LEARN

• How to enforce session fixation protection and rotate session IDs after authentication.
• Configuring concurrent session control: limiting logins per user and handling session expiration events.
• Implementing a custom SessionRegistry to track active sessions across a distributed cluster.
• Setting up a persistent “remember‑me” token store (JDBC, Redis, or JPA) instead of the insecure default.
• Securing the remember‑me cookie with HttpOnly, Secure, and same‑site attributes.
• Common pitfalls—such as mixing stateless JWT filters with stateful session management—and how to avoid them.

A SHORT CODE SNIPPET

@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

@Autowired
private DataSource dataSource; // for persistent token repository

@Override
protected void configure(HttpSecurity http) throws Exception {
http
.formLogin()
.loginPage("/login")
.permitAll()
.and()
.sessionManagement()
.sessionFixation().migrateSession() // rotate ID on login
.maximumSessions(1) // one session per user
.maxSessionsPreventsLogin(false) // allow new login, expire old
.sessionRegistry(sessionRegistry())
.and()
.and()
.rememberMe()
.key("mySuperSecretKey")
.tokenValiditySeconds(1209600) // 14 days
.tokenRepository(persistentTokenRepository());
}

@Bean
public SessionRegistry sessionRegistry() {
return new SessionRegistryImpl();
}

@Bean
public PersistentTokenRepository persistentTokenRepository() {
JdbcTokenRepositoryImpl repo = new JdbcTokenRepositoryImpl();
repo.setDataSource(dataSource);
return repo;
}
}

This snippet shows the essential pieces: session fixation protection, a single‑session policy, and a JDBC‑backed remember‑me token store—all configurable in a few fluent calls.

KEY TAKEAWAYS

• Never trust the default session cookie – always enable session fixation protection and consider rotating IDs on every successful authentication.
• Concurrent session control is a first‑line defense against credential sharing and session hijacking; a custom SessionRegistry lets you monitor and revoke sessions centrally.
• Persisted remember‑me tokens are far safer than the in‑memory default; they let you invalidate tokens on password change or logout.
• Cookie attributes matter – HttpOnly, Secure, and SameSite=Strict/Lax dramatically reduce the attack surface for XSS and CSRF exploits.

👉 Read the complete guide with step-by-step examples, common mistakes, and production tips:

Spring Security session management and remember me tutorial — Complete Guide