{"record":{"id":"560e706c8c725fae","repo":"spring-projects/spring-security","slug":"the-presented-remembermeauthenticationtoken-does-n","errorCode":null,"errorMessage":"The presented RememberMeAuthenticationToken does not contain the expected key","messagePattern":"The presented RememberMeAuthenticationToken does not contain the expected key","errorType":"exception","errorClass":"BadCredentialsException","httpStatus":null,"severity":"error","filePath":"core/src/main/java/org/springframework/security/authentication/RememberMeAuthenticationProvider.java","lineNumber":59,"sourceCode":"\tprivate String key;\n\n\tpublic RememberMeAuthenticationProvider(String key) {\n\t\tAssert.hasLength(key, \"key must have a length\");\n\t\tthis.key = key;\n\t}\n\n\t@Override\n\tpublic void afterPropertiesSet() {\n\t\tAssert.notNull(this.messages, \"A message source must be set\");\n\t}\n\n\t@Override\n\tpublic @Nullable Authentication authenticate(Authentication authentication) throws AuthenticationException {\n\t\tif (!supports(authentication.getClass())) {\n\t\t\treturn null;\n\t\t}\n\t\tif (this.key.hashCode() != ((RememberMeAuthenticationToken) authentication).getKeyHash()) {\n\t\t\tthrow new BadCredentialsException(this.messages.getMessage(\"RememberMeAuthenticationProvider.incorrectKey\",\n\t\t\t\t\t\"The presented RememberMeAuthenticationToken does not contain the expected key\"));\n\t\t}\n\t\treturn authentication;\n\t}\n\n\tpublic String getKey() {\n\t\treturn this.key;\n\t}\n\n\t@Override\n\tpublic void setMessageSource(MessageSource messageSource) {\n\t\tthis.messages = new MessageSourceAccessor(messageSource);\n\t}\n\n\t@Override\n\tpublic boolean supports(Class<?> authentication) {\n\t\treturn (RememberMeAuthenticationToken.class.isAssignableFrom(authentication));\n\t}","sourceCodeStart":41,"sourceCodeEnd":77,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/core/src/main/java/org/springframework/security/authentication/RememberMeAuthenticationProvider.java#L41-L77","documentation":"RememberMeAuthenticationProvider.authenticate() compares the key hash of the incoming RememberMeAuthenticationToken with its configured key. On mismatch it throws BadCredentialsException 'The presented RememberMeAuthenticationToken does not contain the expected key'. The shared key validates that the token was issued by the matching remember-me services.","triggerScenarios":"A RememberMeAuthenticationToken created with key A reaches a RememberMeAuthenticationProvider configured with key B — typically RememberMeServices and the provider keys differ.","commonSituations":"TokenBasedRememberMeServices key differs from provider key; key changed after tokens were persisted in cookies/sessions; multiple security filter chains with different remember-me keys; cluster nodes with different key config.","solutions":["Configure the identical key on RememberMeServices and RememberMeAuthenticationProvider","If the key was rotated, have users log in again / invalidate old remember-me cookies","Ensure consistent key across all nodes in a cluster","In multi-filter-chain setups, make sure each chain's provider matches its own services' key"],"exampleFix":"// before\nTokenBasedRememberMeServices services = new TokenBasedRememberMeServices(\"keyOne\", uds);\nnew RememberMeAuthenticationProvider(\"keyTwo\");\n// after\nString key = \"keyOne\";\nTokenBasedRememberMeServices services = new TokenBasedRememberMeServices(key, uds);\nnew RememberMeAuthenticationProvider(key);","handlingStrategy":"validation","validationCode":"RememberMeAuthenticationProvider provider = new RememberMeAuthenticationProvider(key);\nTokenBasedRememberMeServices services = new TokenBasedRememberMeServices(key, uds);\nassert key != null && !key.isBlank();","typeGuard":"boolean hasValidKey(RememberMeAuthenticationToken t, String key) { return key != null && key.hashCode() == t.getKeyHash(); }","tryCatchPattern":"try { return provider.authenticate(auth); } catch (BadCredentialsException e) { log.warn(\"Remember-me token key mismatch, forcing re-login\"); return null; }","preventionTips":["Share one key constant between RememberMeServices and RememberMeAuthenticationProvider","Rotate keys deliberately and invalidate old cookies","Verify keys match in multi-chain and multi-node deployments"],"tags":["spring-security","remember-me","shared-key"],"backgroundTag":"authentication-required","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}