Spring Boot - how to conditionally enable/disable sessions

Question

I've built a REST API service using Spring where I've enabled sessions using MongoDB:

@Configuration
@EnableMongoHttpSession(maxInactiveIntervalInSeconds = Globals.SESSION_MAX_INTERVAL)
public class SessionConfig {

    @Bean
    public AbstractMongoSessionConverter createSessionConverterBean() {
        return new JacksonMongoSessionConverter(Collections.singletonList(new GeoModule()));
    }
}

I would however, like to have control over which connections should be issued a session. Currently, every HTTP request has a session generated for it, but there are scenarios where the session is not needed, and I'd prefer not to clutter up the session storage with session objects that will never be used.

One such scenario is a standalone desktop application that acts as a content management system. This application has no need for HTTP sessions because authentication is done via the application side via a custom authorization header. This application also only accesses endpoints from a certain root route mapping:

Public traffic routes to api.domain.com/pub and the CMS traffic routes through api.domain.com/cpi .

It would be nice to be able to tell Spring that it does not need to create a session for any requests coming to /cpi . The desktop application also provides a unique Origin that I can match as well if that is more easily done.

My Web security looks like this:

@Override
protected void configure(HttpSecurity http) throws Exception {
    http.authorizeRequests()
            .anyRequest()
            .permitAll()
            .and()
            .cors()
            .and()
            .httpBasic();
    http.csrf().disable(); // Self-implemented
}

I've searched all over and haven't found a thing. Can anyone point me in the right direction?

Thanks!

Answer 1

You could add multiple security configuration in the following scheme. Where one is explicitly matching for the all /cpi requests and the other one handling the remaining requests.

You could also configure different authentication methods this way.

@Order(1)
@Configuration
public static class Custom1WebSecurityConfigurerAdapter extends 
WebSecurityConfigurerAdapter {
    http
                .antMatcher("/cpi/**")
                .authorizeRequests()
                ...

    http.sessionManagement() // dont create a session for this configuration
              .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}


@Order(2)
@Configuration
public static class Custom2WebSecurityConfigurerAdapter extends 
WebSecurityConfigurerAdapter {
    http
                .authorizeRequests()
                ...
}

Answer 2

You could try below in application.yml file.

server:
  servlet:
    session:
      persistent: false
      timeout: 0