{"record":{"id":"0c6dffdcac6378cb","repo":"spring-projects/spring-security","slug":"token-for-series-series-does-not-exist","errorCode":null,"errorMessage":"Token for series '<series>' does not exist","messagePattern":"Token for series '<series>' does not exist","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/authentication/rememberme/InMemoryTokenRepositoryImpl.java","lineNumber":51,"sourceCode":" */\npublic class InMemoryTokenRepositoryImpl implements PersistentTokenRepository {\n\n\tprivate final Map<String, PersistentRememberMeToken> seriesTokens = new HashMap<>();\n\n\t@Override\n\tpublic synchronized void createNewToken(PersistentRememberMeToken token) {\n\t\tPersistentRememberMeToken current = this.seriesTokens.get(token.getSeries());\n\t\tif (current != null) {\n\t\t\tthrow new DataIntegrityViolationException(\"Series Id '\" + token.getSeries() + \"' already exists!\");\n\t\t}\n\t\tthis.seriesTokens.put(token.getSeries(), token);\n\t}\n\n\t@Override\n\tpublic synchronized void updateToken(String series, String tokenValue, Date lastUsed) {\n\t\tPersistentRememberMeToken token = getTokenForSeries(series);\n\t\tif (token == null) {\n\t\t\tthrow new IllegalArgumentException(\"Token for series '\" + series + \"' does not exist\");\n\t\t}\n\t\tPersistentRememberMeToken newToken = new PersistentRememberMeToken(token.getUsername(), series, tokenValue,\n\t\t\t\tnew Date());\n\t\t// Store it, overwriting the existing one.\n\t\tthis.seriesTokens.put(series, newToken);\n\t}\n\n\t@Override\n\tpublic synchronized @Nullable PersistentRememberMeToken getTokenForSeries(String seriesId) {\n\t\treturn this.seriesTokens.get(seriesId);\n\t}\n\n\t@Override\n\tpublic synchronized void removeUserTokens(String username) {\n\t\tIterator<String> series = this.seriesTokens.keySet().iterator();\n\t\twhile (series.hasNext()) {\n\t\t\tString seriesId = series.next();\n\t\t\tPersistentRememberMeToken token = this.seriesTokens.get(seriesId);","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/authentication/rememberme/InMemoryTokenRepositoryImpl.java#L33-L69","documentation":"InMemoryTokenRepositoryImpl.updateToken looks up the token for the given series and throws IllegalArgumentException when no token with that series exists, because a token cannot be updated if it was never created.","triggerScenarios":"Calling updateToken(series, tokenValue, lastUsed) with a series id that is not present in the in-memory map — e.g. after a server restart lost all tokens, or with a series from a cookie created by a previous deployment/repository.","commonSituations":"Server restarts wiping the in-memory map while users still present old remember-me cookies; pointing the app at a different repository than the one that issued the token; deleting the user's tokens (removeUserTokens) and then attempting an update; typo'd series id in custom code or tests.","solutions":["Check repository.getTokenForSeries(series) != null before calling updateToken.","Use a persistent repository (JdbcTokenRepositoryImpl) so tokens survive restarts and in-memory loss.","Treat this as an expired/unknown series: reject the remember-me cookie and force re-authentication (the framework does this by catching the exception).","In tests, create the token with createNewToken before updating it."],"exampleFix":"// before\nrepository.updateToken(series, newTokenValue, new Date()); // throws if series unknown\n// after\nif (repository.getTokenForSeries(series) != null) {\n    repository.updateToken(series, newTokenValue, new Date());\n} else {\n    repository.createNewToken(new PersistentRememberMeToken(user, series, newTokenValue, new Date()));\n}","handlingStrategy":"validation","validationCode":"if (repo.getTokenForSeries(series) == null) {\n    // unknown series: force full re-authentication instead of updating\n    return null;\n}","typeGuard":null,"tryCatchPattern":"try {\n    repo.updateToken(series, value, new Date());\n} catch (IllegalArgumentException e) {\n    log.info(\"Unknown remember-me series {}\", series); // treat as expired\n}","preventionTips":["Use a persistent token repository so series survive restarts","Never update a series before createNewToken","After removeUserTokens, do not update the removed series","Treat unknown series as requiring re-login, not a bug"],"tags":["remember-me","in-memory","token","spring-security"],"backgroundTag":"record-not-found","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}