java - Spring Session, Spring Security How to not automatically create a session on a URL that is intercepted without permission?
I made an API server for mobile calls, used Spring Session to connect Redis to share sessions with multiple tomcats, used security to intercept API permissions, and used x-auth-token, which is the header. Token verification. Now I am encountering a problem. Some APIs are not authorized for verification. However, when accessing these APIs, spring will create a session for each request and return a new x-auth-token. This may lead to too many sessions. Please tell me. How to configure it so that this situation does not require creating a session? Create-session="never" has been configured, but it doesn't work. The following is the security configuration
<http realm="Protected API" use-expressions="true" auto-config="false"
create-session="never" entry-point-ref="customAuthenticationEntryPoint">
<intercept-url pattern="/auth/login/phone" access="permitAll()" />
<intercept-url pattern="/**" access="isAuthenticated()" />
<access-denied-handler ref="customAccessDeniedHandler" />
</http>spring session
<!-- 在HTTP的header中使用x-auth-token:來實現session -->
<bean class="org.springframework.session.web.http.HeaderHttpSessionStrategy" />
<!-- This is essential to make sure that the Spring Security session registry
is notified when the session is destroyed. -->
<bean
class="org.springframework.security.web.session.HttpSessionEventPublisher" />
<bean class="org.springframework.session.data.redis.config.annotation.web.http.RedisHttpSessionConfiguration" scope="singleton">
<!-- session为60分钟过期 -->
<property name="maxInactiveIntervalInSeconds" value="${session.maxInactiveIntervalInSeconds}"></property>
</bean>
...
省略redis pool配置