{"record":{"id":"b4451ed6af5e91a3","repo":"spring-projects/spring-security","slug":"can-not-set-remembermecookiename-and-custom-rememb","errorCode":null,"errorMessage":"Can not set rememberMeCookieName and custom rememberMeServices.","messagePattern":"Can not set rememberMeCookieName and custom rememberMeServices\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java","lineNumber":317,"sourceCode":"\t\trememberMeFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());\n\n\t\tSessionAuthenticationStrategy sessionAuthenticationStrategy = http\n\t\t\t.getSharedObject(SessionAuthenticationStrategy.class);\n\t\tif (sessionAuthenticationStrategy != null) {\n\t\t\trememberMeFilter.setSessionAuthenticationStrategy(sessionAuthenticationStrategy);\n\t\t}\n\n\t\trememberMeFilter = postProcess(rememberMeFilter);\n\t\thttp.addFilter(rememberMeFilter);\n\t}\n\n\t/**\n\t * Validate rememberMeServices and rememberMeCookieName have not been set at the same\n\t * time.\n\t */\n\tprivate void validateInput() {\n\t\tif (this.rememberMeServices != null && !DEFAULT_REMEMBER_ME_NAME.equals(this.rememberMeCookieName)) {\n\t\t\tthrow new IllegalArgumentException(\"Can not set rememberMeCookieName and custom rememberMeServices.\");\n\t\t}\n\t}\n\n\t/**\n\t * Returns the HTTP parameter used to indicate to remember the user at time of login.\n\t * @return the HTTP parameter used to indicate to remember the user\n\t */\n\tprivate String getRememberMeParameter() {\n\t\treturn this.rememberMeParameter;\n\t}\n\n\t/**\n\t * If available, initializes the {@link DefaultLoginPageGeneratingFilter} shared\n\t * object.\n\t * @param http the {@link HttpSecurityBuilder} to use\n\t */\n\tprivate void initDefaultLoginFilter(H http) {\n\t\tDefaultLoginPageGeneratingFilter loginPageGeneratingFilter = http","sourceCodeStart":299,"sourceCodeEnd":335,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java#L299-L335","documentation":"RememberMeConfigurer rejects setting a custom rememberMeServices together with a customized rememberMeCookieName, because RememberMeServices implementations own the cookie name; configuring both creates ambiguity about which cookie the remember-me mechanism uses. validateInput() (run in init) throws IllegalArgumentException when rememberMeServices is set and the cookie name differs from the default.","triggerScenarios":"Calling http.rememberMe(r -> r.rememberMeServices(customServices).rememberMeCookieName(\"my-cookie\")) — i.e. both rememberMeServices(...) and a non-default rememberMeCookieName on the same configurer.","commonSituations":"Adding a custom TokenBasedRememberMeServices/PersistentTokenRepository bean while also renaming the cookie from an earlier requirement; copying rememberMe settings between projects that use different mechanisms.","solutions":["Remove rememberMeCookieName(...) and let the custom RememberMeServices control the cookie name (set the cookie name inside the services implementation, e.g. via its constructor)","Alternatively, keep rememberMeCookieName(...) and drop the custom rememberMeServices, configuring token key/repository via rememberMeConfigurer defaults","If both are truly needed, subclass or configure the RememberMeServices so its cookie name matches, and only pass rememberMeServices"],"exampleFix":"// before\nhttp.rememberMe(r -> r.rememberMeServices(services).rememberMeCookieName(\"app-remember-me\"));\n// after\nhttp.rememberMe(r -> r.rememberMeServices(services)); // cookie name set inside services\n// e.g. new TokenBasedRememberMeServices(key, userDetailsService) with setCookieName(\"app-remember-me\")","handlingStrategy":"validation","validationCode":"boolean isRememberMeConfigValid(RememberMeConfigurer<HttpSecurity> r) {\n    boolean customServices = r.getRememberMeServices() != null;\n    boolean customCookie = !\"remember-me\".equals(r.getRememberMeCookieName());\n    return !(customServices && customCookie);\n}","typeGuard":null,"tryCatchPattern":"try {\n    http.rememberMe(r -> r.rememberMeServices(services));\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"rememberMeCookieName and custom rememberMeServices\")) {\n        // remove rememberMeCookieName(...) from the chain\n    }\n}","preventionTips":["Treat RememberMeServices as the owner of cookie configuration — never also set rememberMeCookieName","Set cookie names inside the RememberMeServices constructor when customization is needed","Avoid mixing rememberMe settings copied from different projects"],"tags":["spring-security","remember-me","configuration","illegal-argument"],"backgroundTag":"mutually-exclusive-options","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}