Spring-session: How do we avoid creating sessions for request without x-auth-token header?

[ysjiang4869]

I use spring session and spring security to protect my application. About spring session ,using HeaderHttpSessionStrategy and hazelcast to save. The problem is when authentication failure or recieve options request ,it will also create session and save, how to avoid create those useless sessions?
session config

@Configuration
@EnableHazelcastHttpSession(maxInactiveIntervalInSeconds =86400)
public class JxSessionConfig {

    @Bean
    public HazelcastInstance hazelcastInstance() {
        MapAttributeConfig attributeConfig = new MapAttributeConfig()
                .setName(HazelcastSessionRepository.PRINCIPAL_NAME_ATTRIBUTE)
                .setExtractor(PrincipalNameExtractor.class.getName());

        Config config = new Config();

        config.getMapConfig("spring:session:sessions")
                .addMapAttributeConfig(attributeConfig)
                .addMapIndexConfig(new MapIndexConfig(
                        HazelcastSessionRepository.PRINCIPAL_NAME_ATTRIBUTE, false));

        return Hazelcast.newHazelcastInstance(config);
    }
    @Bean
    public HttpSessionStrategy httpSessionStrategy() {
        return new HeaderHttpSessionStrategy();
    }
}

security config

I have modified sessionCreationPolicy, requestcache and failureHandler but no help.

```
@Override
protected void configure(HttpSecurity httpSecurity) throws Exception {
httpSecurity
// we don't need CSRF because our token is invulnerable
.csrf().disable()
.exceptionHandling().authenticationEntryPoint(unauthorizedHandler).and() //modified default exception process method but this diabled fromlogin
// don't create session
.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.ALWAYS).and()
.headers().frameOptions().sameOrigin().and()
// region we can control our web pages between this
.authorizeRequests()
.antMatchers(HttpMethod.OPTIONS).permitAll()
.antMatchers("/rest/").hasRole("USER") ///TODO to open authority
.antMatchers("/anon/").permitAll()
.antMatchers("/**").permitAll() // later version needed

            .antMatchers("/token/**").permitAll()
            .anyRequest().authenticated().and().requestCache().requestCache(new NullRequestCache());
    //endregion

    // Custom JWT based security filter
    httpSecurity
            .addFilter(authenticationTokenFilterBean());
    // disable page caching
    httpSecurity.headers().cacheControl();
    httpSecurity.requestCache().requestCache(new NullRequestCache());
    httpSecurity.formLogin().failureHandler(authenticationFailureHandler());
    httpSecurity.rememberMe();
}

private AuthenticationFailureHandler authenticationFailureHandler() {
    return new AuthenticationFailureHandler();
}

public class AuthenticationFailureHandler
        extends SimpleUrlAuthenticationFailureHandler {
}

```

[adonley]

I'm having the same issue which appears to be a configuration issue. Upon further inspection there's a SPRING_SECURITY_SAVED_REQUEST being created for every request that's not authenticated (for my particular issue - this might be your issue as well). You may consider using the SessionCreationPolicy of Never if you are making a single page application as described in the SPA documentation to see if that helps.

[adonley]

Just a heads up - solved my problem by using the NullRequestCache:

httpSecurity.requestCache().requestCache(new NullRequestCache());

[CaryGao]

@adonley Same problem, but I use xml to config spring,how to solve?

<b:bean id="nullRequestCache" class="org.springframework.security.web.savedrequest.NullRequestCache"/>

    <http realm="Protected API" use-expressions="true" auto-config="false"
        create-session="always" entry-point-ref="customAuthenticationEntryPoint">
        <intercept-url pattern="/auth/login/phone" access="permitAll()" />
        <csrf disabled="true" />
        <request-cache ref="nullRequestCache" />
    </http>

[rwinch]

This is probably best suited for StackOverflow since it is a question rather than an issue