Spring Security allows you to manage sessions on your server with only some configuration. Some of the most important session management activities are listed here:
- Session creation: This decides when a session needs to be created and the ways in which you can interact with it. In the Spring Security configuration, put in the following code:
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.ALWAYS);
There are four session creation policies that you can choose from. They are as follows:
-
- ALWAYS: Always create a session if it doesn't exist.
- IF_REQUIRED: If required, a session is created.
- NEVER: This will never create a session; rather, it will use the session if it exists.
- STATELESS: No session will be created nor used.
- invalidSession: This controls how the user is intimated if the server sees an invalid session:
http.sessionManagement...
