ServiceStack CredentialsAuthProvider is ignore rememberMe = false

Question

I am using CredentialsAuthProvider with SS v4.0.39, and have been for well over a year. A client has asked what the "remember me" checkbox on the login page does. My understanding was that this determines whether the user's session is persisted across browser tabs.

However, having tested it, when rememberMe = false, the ss-pid cookie is still returned, and if I open other tabs/browser windows, the session is retrieved and user is an "authenticated" user.

Have I mis-understood the behaviour?

Answer 1

Both of ServiceStack ss-id and ss-pid Session Cookies are always created. The ?RememberMe=true parameter indicates that the Users Session should be stored under the permanent Id ss-pid instead of the default Temporary Session Id ss-id which is how Users Sessions can survive Browser restarts since the ss-pid permanent Cookie isn't reset.