Remember Me

The web/rememberme package implements persistent “remember me” authentication using HMAC-signed cookies that are invalidated automatically when the user changes their password. securityhttp has no WithRememberMe option; wire the service and its middleware in yourself, as shown below.

Import

import "github.com/thuongh2/go-security/web/rememberme"

How it works

On login, if the caller opted in, Service.OnLoginSuccess sets a signed cookie: base64(username) : expiryUnix : HMAC(username, expiry, password-hash fragment).
On each subsequent request, rememberme.Middleware calls Autologin, which verifies the HMAC against the current password-hash fragment before trusting anything else in the cookie.
If the user’s password changes, the hash fragment changes, the HMAC no longer matches, and every outstanding remember-me cookie is silently rejected.
Middleware only runs Autologin when the request has no Authentication yet, so it never overrides a session/bearer/API-key authentication that ran earlier in the chain.

Setup

key := []byte(os.Getenv("REMEMBER_ME_KEY")) // >= 32 bytes, never in source
if len(key) < 32 {
    log.Fatal("REMEMBER_ME_KEY must be at least 32 bytes")
}

svc, err := rememberme.NewTokenBased(rememberme.TokenBasedConfig{
    Key: key,
    Fetcher: func(ctx context.Context, username string) (string, bool) {
        u, err := users.LoadUser(ctx, username)
        if err != nil {
            return "", false
        }
        frag := u.PasswordHash
        if len(frag) > 8 {
            frag = frag[len(frag)-8:] // only a short tail travels in the token, so the cookie never carries the full hash, while still invalidating on password change
        }
        return frag, true
    },
})
if err != nil {
    log.Fatalf("remember-me: %v", err)
}

NewTokenBased returns:

rememberme.ErrKeyTooShort if Key is under 32 bytes
rememberme.ErrFetcherRequired if Fetcher is nil — there’s no safe default password-hash source, so it must be supplied

TokenBasedConfig fields:

Field	Default	Notes
`Key`	— (required)	HMAC key, >= 32 bytes
`Fetcher`	— (required)	`UserHashFetcher`, resolves the password-hash fragment
`Validity`	14 days	token lifetime
`Cookie`	name `remember-me`, HttpOnly, SameSite=Lax	`session.CookieConfig`
`InsecureCookie`	`false`	set `true` only for local HTTP dev; the cookie is Secure by default regardless of `Cookie.Secure`
`ParamName`	`"remember-me"`	form field that opts in
`AuthFactory`	`ROLE_USER` authenticated token	builds the `Authentication` returned by autologin

Wiring it into the chain

Mount your own login/logout handlers with the service attached — the WithLogin(...) option doesn’t thread a RememberMe service through — and add rememberme.Middleware to the chain after session resolution, so it only fires when the session cookie didn’t already authenticate the request:

loginHandler := auth.LoginHandler(auth.LoginConfig{
    Manager:    manager,
    Store:      store,
    Cookie:     cookie,
    RememberMe: svc,
})
logoutHandler := auth.LogoutHandler(auth.LogoutConfig{
    Store:      store,
    Cookie:     cookie,
    RememberMe: svc,
})

chain := middleware.New(
    middleware.SecurityHeaders(),
    sessionResolver(store, cookie, users), // your SESSION-cookie -> core.Authentication resolver
    rememberme.Middleware(svc),
    middleware.Anonymous(),
)
handler := chain.Then(mux)

See examples/webapp/main.go in the repo for the complete runnable version of this wiring, including sessionResolver. The opt-in field defaults to remember-me on both the login handler (LoginConfig.RememberMeField) and the service itself (TokenBasedConfig.ParamName):

{ "username": "alice", "password": "s3cret", "remember-me": true }

The cookie is:

HMAC-signed — tamper-proof
Built from a password-hash fragment — self-invalidating on password change
HttpOnly — forced, never accessible to JavaScript
Secure by default — set InsecureCookie: true to opt out, local dev only
SameSite=Lax by default

Force re-authentication for sensitive actions

There’s no built-in way to tell a remembered login apart from a fresh one — tag it yourself via AuthFactory:

svc, err := rememberme.NewTokenBased(rememberme.TokenBasedConfig{
    Key:     key,
    Fetcher: fetchHashFragment,
    AuthFactory: func(username string) core.Authentication {
        return core.NewAuthenticatedToken(username, username,
            append(core.Roles("USER"), core.Authority("REMEMBERED")))
    },
})

func adminHandler(w http.ResponseWriter, r *http.Request) {
    auth := core.MustAuthentication(r.Context())
    if core.HasAuthority(auth.Authorities(), core.Authority("REMEMBERED")) {
        http.Redirect(w, r, "/login?next=/admin/settings", http.StatusFound)
        return
    }
    // ...
}

Foundation

Authentication

Authorization

Session & Cookies

OAuth2 & JWT

HTTP Layer

Resilience

Observability

Distributed Stores

Import

How it works

Setup

Wiring it into the chain

Force re-authentication for sensitive actions

​Import

​How it works

​Setup

​Wiring it into the chain

​Login request

​Cookie security

​Force re-authentication for sensitive actions

Import

How it works

Setup

Wiring it into the chain

Login request

Cookie security

Force re-authentication for sensitive actions