Spring Security Oauth2 generating jsessiond even when create-session="stateless" is used

Question

I am using Spring Security Oauth2 for authentication purpose in my application which is stateless . Below is the code snippet of spring config file
Also I have used <%@ page session="false" %> in all jsps.

<http pattern="/oauth/token" create-session="stateless"
    authentication-manager-ref="clientAuthenticationManager"
    xmlns="http://www.springframework.org/schema/security">
    <intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" />
    <anonymous enabled="false" />
    <http-basic entry-point-ref="clientAuthenticationEntryPoint" />
    <!-- include this only if you need to authenticate clients via request -->
    <!-- parameters -->
    <custom-filter ref="clientCredentialsTokenEndpointFilter"
        after="BASIC_AUTH_FILTER" />
    <access-denied-handler ref="oauthAccessDeniedHandler" />
</http>

<http auto-config="true" create-session="stateless">
    <intercept-url pattern="/oauth/**" access="ROLE_USER" />
    <intercept-url pattern="/welcome*" access="ROLE_USER" />
    <intercept-url pattern="/test" access="ROLE_USER" />
    <form-login login-page="/login" default-target-url="/welcome"
        authentication-failure-url="/loginfailed"
        authentication-success-handler-ref="customAuthenticationSuccessHandler" />
    <logout logout-success-url="/logout" />
    <custom-filter ref="preAuthFilter" after="PRE_AUTH_FILTER" />
    <custom-filter ref="oauth2ClientFilter" after="EXCEPTION_TRANSLATION_FILTER" />
</http>`

Also I have created my own Authorization End point(/authorizeTest) as the one provided by Ouath2(/oauth/authorize) is putting AuthorizationRequest as session Attribute. Following is the code snippet for CustomAuthorizationEndPoint

<beans:bean id="customAuthorizationEndpoint"
    class="com.mkyong.common.controller.CustomAuthorizationEndpoint">
    <beans:property name="tokenGranter" ref="authorizationCodeTokenGranter" />
    <beans:property name="clientDetailsService" ref="clientDetails" />
    <beans:property name="oAuth2RequestFactory" ref="customOAuth2RequestFactory" />
    <beans:property name="authorizationCodeServices"
        ref="inMemoryAuthorizationCodeServices" />
    <beans:property name="dataSource" ref="dataSource" />
</beans:bean>
<beans:bean id="authorizationCodeTokenGranter"
    class="org.springframework.security.oauth2.provider.code.AuthorizationCodeTokenGranter">
    <beans:constructor-arg index="0" ref="tokenServices" />
    <beans:constructor-arg index="1"
        ref="authorizationCodeServices" />
    <beans:constructor-arg index="2" ref="clientDetails" />
    <beans:constructor-arg index="3"
        ref="customOAuth2RequestFactory" />
</beans:bean>


<beans:bean id="customOAuth2RequestFactory"
    class="com.mkyong.common.controller.CustomOAuth2RequestFactory">
    <beans:constructor-arg ref="clientDetails" />
    <beans:property name="dataSource" ref="dataSource" />
    <beans:property name="customAuthorizationRequest" ref="customAuthorizationRequest" />
</beans:bean>

<beans:bean id="customAuthorizationRequest"
    class="com.mkyong.common.controller.CustomAuthorizationRequest">
</beans:bean>


<beans:bean id="authorizationCodeServices"
    class="org.springframework.security.oauth2.provider.code.JdbcAuthorizationCodeServices">
    <beans:constructor-arg ref="dataSource" />

</beans:bean>

But still I am getting jsession generated.

Shaun the Sheep Shaun the Sheep · Accepted Answer · 2014-01-03T13:51:12

Using create-session="stateless" means that you are telling Spring Security not to create a session or store the authentication information for the user. It won't stop other libraries from creating a session if they feel the need to (oauth is a separate project).

I don't really understand why you are labelling the application as stateless, since you are using things like form login. If you don't allow a session to be created, how will somthing like the authorization code flow work? How is the authorization request cached and how will the server know the user is authenticated when they are redirected back to that request? The authentication will be lost since there is no session to tie it to.

Spring Security Oauth2 generating jsessiond even when create-session="stateless" is used

1 Answers