spring-projects/spring-security · error · IllegalArgumentException

Can not set rememberMeCookieName and custom rememberMeServic

Error message

Can not set rememberMeCookieName and custom rememberMeServices.

What it means

RememberMeConfigurer rejects setting a custom rememberMeServices together with a customized rememberMeCookieName, because RememberMeServices implementations own the cookie name; configuring both creates ambiguity about which cookie the remember-me mechanism uses. validateInput() (run in init) throws IllegalArgumentException when rememberMeServices is set and the cookie name differs from the default.

Source

Thrown at config/src/main/java/org/springframework/security/config/annotation/web/configurers/RememberMeConfigurer.java:317

		rememberMeFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());

		SessionAuthenticationStrategy sessionAuthenticationStrategy = http
			.getSharedObject(SessionAuthenticationStrategy.class);
		if (sessionAuthenticationStrategy != null) {
			rememberMeFilter.setSessionAuthenticationStrategy(sessionAuthenticationStrategy);
		}

		rememberMeFilter = postProcess(rememberMeFilter);
		http.addFilter(rememberMeFilter);
	}

	/**
	 * Validate rememberMeServices and rememberMeCookieName have not been set at the same
	 * time.
	 */
	private void validateInput() {
		if (this.rememberMeServices != null && !DEFAULT_REMEMBER_ME_NAME.equals(this.rememberMeCookieName)) {
			throw new IllegalArgumentException("Can not set rememberMeCookieName and custom rememberMeServices.");
		}
	}

	/**
	 * Returns the HTTP parameter used to indicate to remember the user at time of login.
	 * @return the HTTP parameter used to indicate to remember the user
	 */
	private String getRememberMeParameter() {
		return this.rememberMeParameter;
	}

	/**
	 * If available, initializes the {@link DefaultLoginPageGeneratingFilter} shared
	 * object.
	 * @param http the {@link HttpSecurityBuilder} to use
	 */
	private void initDefaultLoginFilter(H http) {
		DefaultLoginPageGeneratingFilter loginPageGeneratingFilter = http

View on GitHub (pinned to 96852e8860)

Solutions

1. Remove rememberMeCookieName(...) and let the custom RememberMeServices control the cookie name (set the cookie name inside the services implementation, e.g. via its constructor)
2. Alternatively, keep rememberMeCookieName(...) and drop the custom rememberMeServices, configuring token key/repository via rememberMeConfigurer defaults
3. If both are truly needed, subclass or configure the RememberMeServices so its cookie name matches, and only pass rememberMeServices

Example fix

// before
http.rememberMe(r -> r.rememberMeServices(services).rememberMeCookieName("app-remember-me"));
// after
http.rememberMe(r -> r.rememberMeServices(services)); // cookie name set inside services
// e.g. new TokenBasedRememberMeServices(key, userDetailsService) with setCookieName("app-remember-me")

boolean isRememberMeConfigValid(RememberMeConfigurer<HttpSecurity> r) {
    boolean customServices = r.getRememberMeServices() != null;
    boolean customCookie = !"remember-me".equals(r.getRememberMeCookieName());
    return !(customServices && customCookie);
}

try {
    http.rememberMe(r -> r.rememberMeServices(services));
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("rememberMeCookieName and custom rememberMeServices")) {
        // remove rememberMeCookieName(...) from the chain
    }
}

When it happens

Trigger: Calling http.rememberMe(r -> r.rememberMeServices(customServices).rememberMeCookieName("my-cookie")) — i.e. both rememberMeServices(...) and a non-default rememberMeCookieName on the same configurer.

Common situations: Adding a custom TokenBasedRememberMeServices/PersistentTokenRepository bean while also renaming the cookie from an earlier requirement; copying rememberMe settings between projects that use different mechanisms.

Related errors

• Unsupported implementation of Sid
• Cannot apply {configurer} to already built object
• managerPassword is required if managerDn is supplied
• org.springframework.security.config.annotation.method.config
• The Filter class {registeredFilter.getName()} does not have

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/b4451ed6af5e91a3. Report an issue: GitHub.