Describe the bug There are more than 1000 opened issues and some issues are 10 years old down on the list. Some of them are about PersistentTokenBasedRememberMeServices which throws CookieTheftException when parallel requests are fired. I think its time to fix remember me functionality cause now it does not fit real world use cases so it is useless. Or let us know some working solution/configuration if we dont want to store password in cookie via TokenBasedRememberMeServices.

https://github.com/spring-projects/spring-security/issues/2449 https://github.com/spring-projects/spring-security/issues/2253 https://github.com/spring-projects/spring-security/issues/2648 https://github.com/spring-projects/spring-security/issues/3079 https://github.com/spring-projects/spring-security/issues/3801

To Reproduce Try to renew session with remember me by me making 2 and more parallel requests. It throws CookieTheftException.

Expected behavior It should renew session for the first request and handle correctly others.