Spring session creation policy per-request?

Question

TL;DR

Is it possible to control the session creation policy in Spring (Security) on a per request basis?

Long version...

I have been using normal login form user authentication for our application. Some of the controllers are @RestControllers and up to now, the default user session tracked by cookie has allowed it to work fine.

(I.e. when an XHR request comes from a page, the request is authenticated to the previously logged in user as the browser sends the JSESSIONID cookie as usual)

I now want to allow some of the @RestController end points to be called from a rest client, rather than browser, so I have created an API token authentication scheme - this works fine.

One of the last bits of cleanup is that the REST calls generate a session, which I'd like to avoid if possible.

I can't set the session policy to NEVER (because i'm still relying on sessions for my web users).

I have tried IF_REQUIRED to no avail.

I have looked at the HttpSessionSecurityContextRepository but it wraps the request, and a session is created whenever the response is flushed.

(See stacktrace below)

Is it possible elsewhere to hook into the session management on a per-request basis?

I can distinguish the type of request easily enough based on the class type of the Authentication object.

at myapp.cfg.WebConfig$1.sessionCreated(WebConfig.java:74)
at io.undertow.servlet.core.ApplicationListeners.sessionCreated(ApplicationListeners.java:300)
at io.undertow.servlet.core.SessionListenerBridge.sessionCreated(SessionListenerBridge.java:56)
at io.undertow.server.session.SessionListeners.sessionCreated(SessionListeners.java:52)
at io.undertow.server.session.InMemorySessionManager.createSession(InMemorySessionManager.java:187)
at io.undertow.servlet.spec.ServletContextImpl.getSession(ServletContextImpl.java:741)
at io.undertow.servlet.spec.HttpServletRequestImpl.getSession(HttpServletRequestImpl.java:370)
at javax.servlet.http.HttpServletRequestWrapper.getSession(HttpServletRequestWrapper.java:270)
at org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper.createNewSessionIfAllowed(HttpSessionSecurityContextRepository.java:427)
at org.springframework.security.web.context.HttpSessionSecurityContextRepository$SaveToSessionResponseWrapper.saveContext(HttpSessionSecurityContextRepository.java:364)
at org.springframework.security.web.context.SaveContextOnUpdateOrErrorResponseWrapper.onResponseCommitted(SaveContextOnUpdateOrErrorResponseWrapper.java:85)
at org.springframework.security.web.util.OnCommittedResponseWrapper.doOnResponseCommitted(OnCommittedResponseWrapper.java:245)
at org.springframework.security.web.util.OnCommittedResponseWrapper.access$000(OnCommittedResponseWrapper.java:33)
at org.springframework.security.web.util.OnCommittedResponseWrapper$SaveContextServletOutputStream.flush(OnCommittedResponseWrapper.java:512)
at org.springframework.security.web.util.OnCommittedResponseWrapper$SaveContextServletOutputStream.flush(OnCommittedResponseWrapper.java:513)
at com.fasterxml.jackson.core.json.UTF8JsonGenerator.flush(UTF8JsonGenerator.java:1050)
at com.fasterxml.jackson.databind.ObjectWriter.writeValue(ObjectWriter.java:953)

Answer 1

Split your security configuration into separate sections for a form login (session based API access) and a stateless API token authentication scheme.

Example:

@Configuration
@EnableWebSecurity
public class SecurityConfiguration {

    @Order(1)
    @Configuration
    class ApiSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .antMatcher("/api/**")
            .authorizeRequests().anyRequest().authenticated()
            .and()
            .httpBasic().realmName("API") // your API token authentication scheme 
            .and()
            .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
            .and()
            .exceptionHandling().authenticationEntryPoint(new Http401AuthenticationEntryPoint("Form realm=\"API\"")); // prevent basic authentication popup in browser
    }
    }

    @Order(2)
    @Configuration
    class DefaultSecurityConfiguration extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .formLogin().loginPage("/login").permitAll()
            .and()
            .logout().logoutSuccessUrl("/login").permitAll();
    }
    }
}

Replace .httpBasic().realmName("API") with you own authentication scheme.

Call your API with e.g. curl -v ... and verify that there is no Set-Cookie header in the response. Otherwise your code somewhere creates an http session on its own.