Spring Security - Third Edition

Configuring how Spring Security uses HttpSession

Spring Security has the ability to configure when the session is created by Spring Security. This can be done with the http element's create-session attribute. A summary of the options can be seen in the following table:

Attribute value	Description
ifRequired	Spring Security will create a session only if one is required (default value).
always	Spring Security will proactively create a session if one does not exist.
never	Spring Security will never create a session, but will make use of one if the application does create it. This means if there is a HttpSession method, SecurityContext will be persisted or retrieve from it.
stateless	Spring Security will not create ...