Spring documentation says that remember me is implemented by storing following information in cookie -
base64(username + ":" + expirationTime + ":" + md5Hex(username + ":" + expirationTime + ":" password + ":" + key))
I have following confusions -
Why use an unsecure hash like MD5 to digest the information instead of using SHA-1 or SHA-2. Would the performance hit from these be significant for such a small piece of information?
Why transmit this information over the network at all? Why not maintain a map of cryptographically secure random number and this info on the server, returning only the map key as a cookie. AFAIK this is the approach used by Servlet API and is deemed more secure.