we use Spring security 3.1.2.RELEASE and we need to switch off HttpSession. Is there any way how to do it? We tryed to use create-session="stateless" attribute of http element, but without any success. Is there any way how to switch of session or at least find where session is created? Thanks
Asked
Active
Viewed 77 times
0
-
What do you mean by *switch off HttpSession* ? – Aleksandr M Jan 28 '15 at 15:12
-
We need to access our RestWeb services without sessions. Spring security create one new session per request, and we need to switch it of, so result will be 0 session per request. – Petr Kostroun Jan 28 '15 at 15:15
1 Answers
0
I'd start with this FAQ. You can also find out where the session is created by adding <debug /> to your XML configuration.
Some authentication mechanisms require a session, but others don't. If you use never as the create-session attribute value then Spring Security won't create a session itself. The stateless option should be supported in 3.1, so I'd guess your application is most likely creating the sessions itself. In any case it would help if you clarify what you mean by "without any success" - i.e what actually happens, is there an error?.
Shaun the Sheep
- 22,353
- 1
- 72
- 100