Spring Security禁用rememberMe不起作用

Question

I have Spring Boot application. It is necessary to send Authorization header on every request otherwise deny access to resource.

But if I made request with this header once I can send requests without it and receive content of resource. Why? Where am I wrong in code?

Spring Security configuration:

@Configuration
@EnableWebSecurity
@EnableGlobalMethodSecurity(securedEnabled = true)
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http
            .rememberMe().disable()
            .csrf().disable()
            .authorizeRequests().anyRequest().fullyAuthenticated().and()
            .httpBasic().and()
            .formLogin().disable()
            .logout().disable();
    }

    @Autowired
    public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
        auth
            .inMemoryAuthentication()
            .withUser("1").password("1").roles("USER");
    }
}

Controller:

    @RestController
    public class FooController {

        @RequestMapping("/foo")
        public Bar bar() {
            Bar bar = new Bar();
            return bar;
        }
    }

Answer 1

    http
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

Disable create session. Session Management