title: Symfony: Avoid session on every request
body: <p>I have an application based on symfony 2.8, and every page request every new session is created.</p>
  
  <p>For example
  if /api/check is called 1000 times, 1000 sessions will be created unnecessarily.</p>
  
  <p>firewalls:
          # disables authentication for assets and the profiler, adapt it according to your needs
          dev:
              pattern: ^/(_(profiler|wdt)|css|images|js)/
              security: false</p>
  
  <pre><code>    api:
          pattern:  /api/
          anonymous: ~
          stateless:  true
  
      main:
          pattern: ^/
          form_login:
              # the user is redirected here when needed to log in
              login_path: security_login_register # URL: /willkommen
  
              # login handler via FOSUserBundle
              provider: fos_userbundle
  
              # name of input field of csrf token
              csrf_parameter: _csrf_token
  
              # token provider
              csrf_provider: security.csrf.token_manager # Use form.csrf_provider instead for Symfony &lt;2.4
              # DIRECTION OPTIONS:
              # /vendor/symfony/symfony/src/Symfony/Component/Security/Http/Authentication/DefaultAuthenticationSuccessHandler.php
  
              # OPTION 1: if set true, redirect always to default_target_path after login
              # DEFAULT: false
              always_use_default_target_path: false  # DEFAULT: false
              default_target_path: profile_order_list # URL: /profile/orders
  
              # OPTION 2: if option 1 not enabled, the URL of _target_path will be used for redirection
              # name of input field for redirection for form_login
              target_path_parameter: _target_path
  
              # OPTIONS 3: if option 1, 2 not enabled and user_refer is true, URL from $request-&gt;headers-&gt;get('Referer')
              # will be used for redirection
              # disabled using header referrer
              use_referer: false # DEFAULT: false
  
              # OPTION 4: if nothing found, URL of default_target_path will be used for redirection
  
              # do not remeber_me with higher security
              remember_me: false
  
          logout:
              path: fos_user_security_logout
              target: homepage  # URL: /
          anonymous:    true
          switch_user:  true
  </code></pre>
  
  <p>The above block doesn't work in security config. I tried to make /api route stateless but doesn't work, any idea?</p>