title: How to prevent HTTP session flood attack
body: <p><strong>Flood Attack:</strong>
  In short, a hacker can keep hitting the server (without cookie) to force Java container to keep creating new session.</p>
  
  <p>I am using Spring Security to manage session. I realize <code>jsessionid</code> keep being created before login, this is not what I want.</p>
  
  <p>So I did:</p>
  
  <p>1) in Spring security config:</p>
  
  <pre><code>sessionManagement().sessionCreationPolicy(SessionCreationPolicy.NEVER)
  </code></pre>
  
  <p>2) disable session creation in jsp. Because I am using apache tile, due to it is using dynamic include, so I have to disable session creation in all the jsp fragment. This is very tedious.</p>
  
  <pre><code>&lt;%@page session="false"%&gt;
  </code></pre>
  
  <p>First glance, it is fine, but there is a scenario I still got the session created.</p>
  
  <p>Let's say before login, I visit a url that only can be visited after authenticated, Spring will redirect me to login page.</p>
  
  <p>Before I am redirected, the response already instruct to set a new cookie, a session already created.</p>
  
  <p>My Question:</p>
  
  <p>1) Is session flood attack a serious issue? Should I really take care of it? </p>
  
  <p>2) Is there any better way to handle this issue? Any best practise? </p>
  
  <p>3) What happen to my code? It should work actually, I suspect the cookie is created by Spring, although I already set it to <code>SessionCreationPolicy.NEVER</code>. I can't set it to <code>Stateless</code>, I still need the session after login.</p>
  
  <p>I am more concerned session attack compare to DDOS actually, I have also set <code>.maximumSessions(1)</code> in Spring to prevent multiple login. But above issue happen before login. Please help. Thanks.</p>