title: How to make spring boot never issue session cookie?
body: <p>I'm developing Restful API server by using spring boot. I configured my project to use basic authentication as below.</p>
  
  <pre><code>@ComponentScan
  @EnableAutoConfiguration
  @EnableWebSecurity
  @Configuration
  public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
      ...
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER).and()
              .csrf().disable()
              .authorizeRequests().anyRequest().hasRole("USER").and()
              .httpBasic();
      }
      ...
  }
  </code></pre>
  
  <p>But when I tested the API by Chrome-Postman-Plugin, after first call, server never require user credential. And I noticed that 'JSESSIONID' cookie was created.</p>
  
  <p>There are no other security configurations in my project. I wonder why this happens...</p>