Spring Security "Remember Me" option not restoring sessions

[George Smithss]

Suddenly Spring security remember-me option has stopped to work. Now when I check "remember me" checkbox at login page and then close my browser, it asks me to login again instead of just restoring my session.
remember-me

Further investigation revealed that:

It still creates new series/token/last_used fields in DB, but never updates it. So everytime I login with the same username it just creates new record. If I logout, it clears all user's token records.

It creates remember-me cookie at first, but loosing it after I close my browser.

It's not browser-related error.

It never calls updateToken or getTokenForSeries methods of JDBCTokenRepositoryImpl. Just createNewToken when the checkbox is checked and removeUserTokens when I logout.

It isn't calls loadUserByUsername method of UserDetailsService's implementation

If I switch from JDBCTokenRepository to InMemoryTokenRepository it still not works. So I beleive it's not DB related error.

Now I'm stucked what else can I do to restore "remember me" functionality. Any advice for further investigation would be appreciated.

UserDetailsService

@Service
public class UserDetailsServiceImpl implements UserDetailsService {

    @Autowired
    UserService userService;

    public UserDetails loadUserByUsername(String userName) throws UsernameNotFoundException {

        Optional<User> optusr = userService.findByName(userName);
        if (!optusr.isPresent()) {
            throw new UsernameNotFoundException("User not found");
        }
        User usr = optusr.get();
        System.out.println (usr.getUsername());
        System.out.println (userService.getRolesByString(usr));

        return usr;
    }
}

WebSecurityConfig

@Configuration
@EnableWebSecurity 
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {

    @Autowired
    UserService userService;
    @Autowired
    UserDetailsServiceImpl userDetailsService;
 /*   @Autowired
    private DataSource dataSource; */

    @Bean
    public BCryptPasswordEncoder passwordEncoder() {
    //Password encoder settings to avoid storing plain passwords in DB
        return new BCryptPasswordEncoder();
    }

    @Bean
    public PersistentTokenRepository persistentTokenRepository() {
    //Choose where to save user session: DB or memory (in our case: DB)
        //JdbcTokenRepositoryImpl db = new JdbcTokenRepositoryImplCust();
        //db.setDataSource(dataSource);
        InMemoryTokenRepositoryImpl db = new InMemoryTokenRepositoryImpl();
        return db;
    }

    @Override
    public void configure(AuthenticationManagerBuilder auth) throws Exception {
    //Settings service to find User in DB + password
        auth
            .userDetailsService(userDetailsService)
            .passwordEncoder(new BCryptPasswordEncoder());
    }

    @Override
    protected void configure(HttpSecurity http) throws Exception {
    //Main method for Spring's web security
        http
            // URL checks
            .authorizeRequests()
                .antMatchers("/resource/**").permitAll()
                .antMatchers("/users").hasRole("ADMIN") //Only users with Admin Role can see it
                .anyRequest().authenticated() //All another URL requires authorization
                .and()
            // Login forms
            .formLogin()
                .loginPage("/login")
                .defaultSuccessUrl("/main")//Redirect page if
                .failureUrl("/login?error")
                .usernameParameter("username") //parse from POST
                .passwordParameter("password") //parse from POST
                .permitAll()
                .and()
            // Actions when logoff
            .logout()
                .permitAll() 
                .logoutUrl("/logout")
                .logoutSuccessUrl("/login?logout")
                .invalidateHttpSession(true)
                .and()
            // Exceptions
            .exceptionHandling()
                .accessDeniedPage("/denied")
                .and()
            //Cookies
            .rememberMe()
                .tokenRepository(this.persistentTokenRepository()) //Choose sessions repository
                .rememberMeParameter("remember-me")
                .alwaysRemember(true) //- always remember ignoring checkbox
                .tokenValiditySeconds(1 * 24 * 60 * 60) //24H
                .userDetailsService(userDetailsService)
            ;
    }
}

[Himai Minh]

How about rememberMe().key() ?
The following reference says the key() is important.
https://www.baeldung.com/spring-security-remember-me

[Himai Minh]

Hi George,
I tried an example with rememberMe() feature with Google Chrome.
Please make sure your Chrome will not clear cookies after you close it Also, it should allow the sites to save cookies.
Please see the attached screenshot for Chrome's privacy settings.

If you see the "remember me on this computer" checkbox, check on it. Then, log in. Close the browser and open it again. You don't need to log in.

[George Smithss]

Himai Minh wrote:Hi George,
I tried an example with rememberMe() feature with Google Chrome.
Please make sure your Chrome will not clear cookies after you close it Also, it should allow the sites to save cookies.

Thank you. It works.
Suddenly our administrators forced that policy for chrome, so "remember me" cookie disappeared after browser's close.
I forced it back, so now it works as expected.