Spring 4 会话管理

Question

I have concern regarding session creation in Spring 4 .

When ever any jsp page is rendered from server, spring creates session. For example url is GET /login , then Login.jsp served and session is automatically created and sent with response.

It is affecting my session handling, because I have filter which executes before DispatcherServlet and checks for the session.

If session is not active it redirects to login , but after login.jsp page is rendered then it creates session.

So once page is passed to user his session gets activated and he can access the protected resource.

I can solve this problem by adding some tokens but is there any way by which we can prevent session creation?

I'm using spring 4. I've tried SessionCreationPolicy.STATELESS and others but didn't work.

How to prevent session creation?

Thanks,
Sandeep

Answer 1

This problem is not specific to Spring. JSP creates session by default. So make sure that your JSPs don't implicitly do that by setting <%@page session="false"%>