{"action":"created","issue":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/5299","repository_url":"https://api.github.com/repos/spring-projects/spring-security","labels_url":"https://api.github.com/repos/spring-projects/spring-security/issues/5299/labels{/name}","comments_url":"https://api.github.com/repos/spring-projects/spring-security/issues/5299/comments","events_url":"https://api.github.com/repos/spring-projects/spring-security/issues/5299/events","html_url":"https://github.com/spring-projects/spring-security/issues/5299","id":320235818,"number":5299,"title":"CSRF protection should not create a HTTP session if session creation policy is set to STATELESS","user":{"login":"mvitz","id":563587,"avatar_url":"https://avatars0.githubusercontent.com/u/563587?v=4","gravatar_id":"","url":"https://api.github.com/users/mvitz","html_url":"https://github.com/mvitz","followers_url":"https://api.github.com/users/mvitz/followers","following_url":"https://api.github.com/users/mvitz/following{/other_user}","gists_url":"https://api.github.com/users/mvitz/gists{/gist_id}","starred_url":"https://api.github.com/users/mvitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mvitz/subscriptions","organizations_url":"https://api.github.com/users/mvitz/orgs","repos_url":"https://api.github.com/users/mvitz/repos","events_url":"https://api.github.com/users/mvitz/events{/privacy}","received_events_url":"https://api.github.com/users/mvitz/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2018-05-04T11:08:58Z","updated_at":"2018-05-07T17:12:41Z","closed_at":null,"author_association":"NONE","body":"### Summary\r\n\r\nBy default CSRF protection creates a HTTP session even if session creation policy is configured to be STATELESS. This should not be the case as an user expects no session to occur (within Spring Security) after specifying STATELESS.\r\n\r\n### Actual Behavior\r\n\r\nA HTTP session is created when visiting the login page.\r\n\r\n### Expected Behavior\r\n\r\nNo HTTP session should be created.\r\n\r\n### Configuration\r\n\r\n```\r\n@Bean\r\npublic WebSecurityConfigurerAdapter webSecurityConfigurerAdapter() {\r\n    return new WebSecurityConfigurerAdapter() {\r\n        @Override\r\n        protected void configure(HttpSecurity http) throws Exception {\r\n             http\r\n                 .sessionManagement().sessionCreationPolicy(STATELESS)\r\n             .and()\r\n                 .authorizeRequests().anyRequest().authenticated()\r\n             .and()\r\n                 .formLogin()\r\n        }\r\n    };\r\n}\r\n```\r\n\r\n### Version\r\n\r\n5.0.4.RELEASE\r\n\r\n### Sample\r\n\r\nA sample application (using Spring Boot 2.x) can be found at https://github.com/mvitz/spring-security-csrf-issues/tree/master/stateless-session-creation-policy\r\n"},"comment":{"url":"https://api.github.com/repos/spring-projects/spring-security/issues/comments/387135778","html_url":"https://github.com/spring-projects/spring-security/issues/5299#issuecomment-387135778","issue_url":"https://api.github.com/repos/spring-projects/spring-security/issues/5299","id":387135778,"user":{"login":"mvitz","id":563587,"avatar_url":"https://avatars0.githubusercontent.com/u/563587?v=4","gravatar_id":"","url":"https://api.github.com/users/mvitz","html_url":"https://github.com/mvitz","followers_url":"https://api.github.com/users/mvitz/followers","following_url":"https://api.github.com/users/mvitz/following{/other_user}","gists_url":"https://api.github.com/users/mvitz/gists{/gist_id}","starred_url":"https://api.github.com/users/mvitz/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mvitz/subscriptions","organizations_url":"https://api.github.com/users/mvitz/orgs","repos_url":"https://api.github.com/users/mvitz/repos","events_url":"https://api.github.com/users/mvitz/events{/privacy}","received_events_url":"https://api.github.com/users/mvitz/received_events","type":"User","site_admin":false},"created_at":"2018-05-07T17:12:41Z","updated_at":"2018-05-07T17:12:41Z","author_association":"NONE","body":"Maybe updating the Javadoc of STATELESS would be an option then?"}}
{"actor":{"display_login":"mvitz"}}