spring-projects / spring-security

Spring Security
http://spring.io/projects/spring-security
Apache License 2.0
8.74k stars 5.86k forks source link

Support Remember-Me for OAuth2 login #15078

Open gotson opened 4 months ago

gotson commented 4 months ago

When OAuth2 login is enabled, remember-me parameter (ie when it's not set to always remember) will not be honored, because the original request (to /oauth2/authorization/<provider>) is different from the actual request coming back from the OAuth2 provider (to /login/oauth2/code/<provider>), and that second request does not have the remember-me parameter set.

It would be good if this could be supported, ie when calling /oauth2/authorization/<provider>?remember-me=true, the response would set the remember-me cookie.

Expected Behavior

Remember-me cookie is set on OAuth2 login response

Current Behavior

Remember-me cookie is not set on OAuth2 login response

Context

My application offers optional OAuth2 login, along with traditional username/password login. There is a checkbox for remember-me, but this does not apply to OAuth2 login currently.