请记住我的WebFlux安全应用程序和X-CSRF令牌
我有一个与Spring后端通信的NextJS应用程序，我正在正确获取会话和X-CSRF cookie，但是当关闭浏览器窗口然后重新打开时，它们仅在浏览器会话中持续使用，我希望我的用户能够能够仍在会议中，不必每次都再次登录。
我知道春季安全性“记住我”，不幸的是，我正在使用webflux安全性，而serverhttpsecurity没有记住我的功能，我看到了这个问题 https://github.com/spring-projects/spring-security/issues/5504 ，但无法很好地理解他们对解决方案的含义。
我正在使用春季会议，既然我们不记得我，我不知道最好的步骤是什么？我是否必须设置两个cookie的最大年龄，并在我希望用户登录的日子里使用它们？这是最好的行动方案吗？
我不想迁移到常规的Spring Servlet安全性，除非这是解决此问题的唯一方法。
I have a NextJS app that communicates with a Spring backend, I'm getting the SESSION and X-CSRF cookie correctly but they only last for the browser session, when the browser window is closed and then reopened I want my users to be able to still be in the session and not have to login again every time.
I know that Spring Security has "Remember me" unfortunately I'm using WebFlux Security and ServerHttpSecurity doesn't have the remember me functionality, I saw this issue https://github.com/spring-projects/spring-security/issues/5504 but couldn't understand well what they mean with the solution.
I'm using Spring Session and since we can't have remember me, I don't know what exactly are the best steps to take? Would I have to set the Max Age of both cookies and used them for the days that I want my users to be logged in? Is this the best course of action?
I don't want to migrate to regular Spring Servlet Security unless it was the only way to solve this.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
由于记住我不在WebFlux安全应用程序上，因此我想到的唯一解决方案是cookie。
您可以使用此指南在春季会议上，对于CSRF代币，您可以在cookieservercsrftokenrepository上设置最大年龄，就像实现的一样/pull/11433“ rel =” nofollow noreferrer“>在这里，这种更改将在下一个安全版本中进行。
通过设置最大年龄，当您重新打开浏览器窗口时，您仍然可以使用相同的会话，除非服务器会话限制。
我不知道这是否是最好的解决方案，但是如果有人想添加其他很棒的东西。
Since RememberMe isn't on WebFlux Security applications therefore the only solution I think of, is with the cookies.
You could modify the session cookie in the webflux application by using this guide from Spring Session, for the CSRF token, you could set the max age on CookieServerCsrfTokenRepository, like it was implemented here and that change is coming in the next Security versions.
By setting the max age, you can still use the same session when you reopen the browser window, unless the server session times out.
I don't know if that's the best solution, but if someone wants to add something else that would be great.