java - Spring Security: The authentication stays after server restart -

after restarted tomcat, found out authentication still there, have logged in again. however, after used clean tomcat work directory, authentication lost(switched anonymoususer).

so how spring security remember authentication between tomcat shutdowns?

what in work directory related authentication removed?

is related remember-me functionality?

tomcat persists sessions between server restarts. can change behavior in tomcat configuration

from tomcat docs

whenever apache tomcat shut down , restarted, or when application reload triggered, standard manager implementation attempt serialize active sessions disk file located via pathname attribute. such saved sessions deserialized , activated (assuming have not expired in mean time) when application reload completed.