Mixing
How to prevent creating HttpSession in Spring REST Controller
0
In our project we have implemented a few REST Services using Spring @RestController. The problem is when I test them using a REST Client, in response header there exists JSESSIONID, So I believe the server creates an HTTPSession for each request, but the services are stateless and they don't need HTTPSession.
Is there any way to prevent creating new sessions in this controllers?
This is the source of RestController
@RestController
@RequestMapping("/customs/customs")
public class CustomsRestController {
@Autowired
private CustomsWebService customsWebService;
@Autowired
private CustomsSecurityContextInitializer securityContextInitializer;
@RequestMapping(path = "/customsPorts", method = RequestMethod.GET,
consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public Collection<CustomsPort> getActiveCustomsPorts() {
try {
securityContextInitializer.initSecurityContext();
return customsWebService.getActiveCustomsPorts();
} finally {
securityContextInitializer.clearSecurityContext();
}
}
@RequestMapping(path = "/registerCustomsRequest", method = RequestMethod.POST,
consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public CustomsDeclarationInfo registerCustomsRequest(@RequestBody CustomsDeclarationRequest requestKey) {
try {
securityContextInitializer.initSecurityContext();
requestKey.validate();
return customsWebService.registerCustomsRequest(requestKey);
} catch (BusinessException e) {
return CustomsDeclarationInfo.builder().errorMessage(e.getMessage()).build();
} finally {
securityContextInitializer.clearSecurityContext();
}
}
}
java spring spring-mvc spring-restcontroller httpsession
asked Nov 21 '18 at 6:38
Amir PashazadehAmir Pashazadeh
5,89212349
add a comment |
0
In our project we have implemented a few REST Services using Spring @RestController. The problem is when I test them using a REST Client, in response header there exists JSESSIONID, So I believe the server creates an HTTPSession for each request, but the services are stateless and they don't need HTTPSession.
Is there any way to prevent creating new sessions in this controllers?
This is the source of RestController
@RestController
@RequestMapping("/customs/customs")
public class CustomsRestController {
@Autowired
private CustomsWebService customsWebService;
@Autowired
private CustomsSecurityContextInitializer securityContextInitializer;
@RequestMapping(path = "/customsPorts", method = RequestMethod.GET,
consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public Collection<CustomsPort> getActiveCustomsPorts() {
try {
securityContextInitializer.initSecurityContext();
return customsWebService.getActiveCustomsPorts();
} finally {
securityContextInitializer.clearSecurityContext();
}
}
@RequestMapping(path = "/registerCustomsRequest", method = RequestMethod.POST,
consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public CustomsDeclarationInfo registerCustomsRequest(@RequestBody CustomsDeclarationRequest requestKey) {
try {
securityContextInitializer.initSecurityContext();
requestKey.validate();
return customsWebService.registerCustomsRequest(requestKey);
} catch (BusinessException e) {
return CustomsDeclarationInfo.builder().errorMessage(e.getMessage()).build();
} finally {
securityContextInitializer.clearSecurityContext();
}
}
}
java spring spring-mvc spring-restcontroller httpsession
asked Nov 21 '18 at 6:38
Amir PashazadehAmir Pashazadeh
5,89212349
see stackoverflow.com/questions/22817012/…
– Scary Wombat
Nov 21 '18 at 6:43
I think the answer is not correct, an HTTPSession must not be created if you don't ask the server to do it. In normal JSP/Servlet (and many other frameworks) it is default to create an HTTPSession, but in REST Application it is not.
– Amir Pashazadeh
Nov 21 '18 at 6:54
Please back that up with a source
– Scary Wombat
Nov 21 '18 at 6:58
Check this : stackoverflow.com/questions/34673836/…
– Mohammadreza Khatami
Nov 21 '18 at 8:25
Possible duplicate of Disable HTTPSession for stateless web services
– Alan Hay
Nov 21 '18 at 9:02
add a comment |
0
0
0
In our project we have implemented a few REST Services using Spring @RestController. The problem is when I test them using a REST Client, in response header there exists JSESSIONID, So I believe the server creates an HTTPSession for each request, but the services are stateless and they don't need HTTPSession.
Is there any way to prevent creating new sessions in this controllers?
This is the source of RestController
@RestController
@RequestMapping("/customs/customs")
public class CustomsRestController {
@Autowired
private CustomsWebService customsWebService;
@Autowired
private CustomsSecurityContextInitializer securityContextInitializer;
@RequestMapping(path = "/customsPorts", method = RequestMethod.GET,
consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public Collection<CustomsPort> getActiveCustomsPorts() {
try {
securityContextInitializer.initSecurityContext();
return customsWebService.getActiveCustomsPorts();
} finally {
securityContextInitializer.clearSecurityContext();
}
}
@RequestMapping(path = "/registerCustomsRequest", method = RequestMethod.POST,
consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public CustomsDeclarationInfo registerCustomsRequest(@RequestBody CustomsDeclarationRequest requestKey) {
try {
securityContextInitializer.initSecurityContext();
requestKey.validate();
return customsWebService.registerCustomsRequest(requestKey);
} catch (BusinessException e) {
return CustomsDeclarationInfo.builder().errorMessage(e.getMessage()).build();
} finally {
securityContextInitializer.clearSecurityContext();
}
}
}
java spring spring-mvc spring-restcontroller httpsession
asked Nov 21 '18 at 6:38
Amir PashazadehAmir Pashazadeh
5,89212349
In our project we have implemented a few REST Services using Spring @RestController. The problem is when I test them using a REST Client, in response header there exists JSESSIONID, So I believe the server creates an HTTPSession for each request, but the services are stateless and they don't need HTTPSession.
Is there any way to prevent creating new sessions in this controllers?
This is the source of RestController
@RestController
@RequestMapping("/customs/customs")
public class CustomsRestController {
@Autowired
private CustomsWebService customsWebService;
@Autowired
private CustomsSecurityContextInitializer securityContextInitializer;
@RequestMapping(path = "/customsPorts", method = RequestMethod.GET,
consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public Collection<CustomsPort> getActiveCustomsPorts() {
try {
securityContextInitializer.initSecurityContext();
return customsWebService.getActiveCustomsPorts();
} finally {
securityContextInitializer.clearSecurityContext();
}
}
@RequestMapping(path = "/registerCustomsRequest", method = RequestMethod.POST,
consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
public CustomsDeclarationInfo registerCustomsRequest(@RequestBody CustomsDeclarationRequest requestKey) {
try {
securityContextInitializer.initSecurityContext();
requestKey.validate();
return customsWebService.registerCustomsRequest(requestKey);
} catch (BusinessException e) {
return CustomsDeclarationInfo.builder().errorMessage(e.getMessage()).build();
} finally {
securityContextInitializer.clearSecurityContext();
}
}
}
java spring spring-mvc spring-restcontroller httpsession
java spring spring-mvc spring-restcontroller httpsession
asked Nov 21 '18 at 6:38
Amir PashazadehAmir Pashazadeh
5,89212349
asked Nov 21 '18 at 6:38
Amir PashazadehAmir Pashazadeh
5,89212349
edited Nov 21 '18 at 8:03
Amir Pashazadeh
asked Nov 21 '18 at 6:38
Amir PashazadehAmir Pashazadeh
5,89212349
asked Nov 21 '18 at 6:38
Amir PashazadehAmir Pashazadeh
5,89212349
asked Nov 21 '18 at 6:38
Amir PashazadehAmir Pashazadeh
5,89212349
5,89212349
see stackoverflow.com/questions/22817012/…
– Scary Wombat
Nov 21 '18 at 6:43
I think the answer is not correct, an HTTPSession must not be created if you don't ask the server to do it. In normal JSP/Servlet (and many other frameworks) it is default to create an HTTPSession, but in REST Application it is not.
– Amir Pashazadeh
Nov 21 '18 at 6:54
Please back that up with a source
– Scary Wombat
Nov 21 '18 at 6:58
Check this : stackoverflow.com/questions/34673836/…
– Mohammadreza Khatami
Nov 21 '18 at 8:25
Possible duplicate of Disable HTTPSession for stateless web services
– Alan Hay
Nov 21 '18 at 9:02
add a comment |
see stackoverflow.com/questions/22817012/…
– Scary Wombat
Nov 21 '18 at 6:43
I think the answer is not correct, an HTTPSession must not be created if you don't ask the server to do it. In normal JSP/Servlet (and many other frameworks) it is default to create an HTTPSession, but in REST Application it is not.
– Amir Pashazadeh
Nov 21 '18 at 6:54
Please back that up with a source
– Scary Wombat
Nov 21 '18 at 6:58
Check this : stackoverflow.com/questions/34673836/…
– Mohammadreza Khatami
Nov 21 '18 at 8:25
Possible duplicate of Disable HTTPSession for stateless web services
– Alan Hay
Nov 21 '18 at 9:02
see stackoverflow.com/questions/22817012/…
– Scary Wombat
Nov 21 '18 at 6:43
see stackoverflow.com/questions/22817012/…
– Scary Wombat
Nov 21 '18 at 6:43
I think the answer is not correct, an HTTPSession must not be created if you don't ask the server to do it. In normal JSP/Servlet (and many other frameworks) it is default to create an HTTPSession, but in REST Application it is not.
– Amir Pashazadeh
Nov 21 '18 at 6:54
I think the answer is not correct, an HTTPSession must not be created if you don't ask the server to do it. In normal JSP/Servlet (and many other frameworks) it is default to create an HTTPSession, but in REST Application it is not.
– Amir Pashazadeh
Nov 21 '18 at 6:54
Please back that up with a source
– Scary Wombat
Nov 21 '18 at 6:58
Please back that up with a source
– Scary Wombat
Nov 21 '18 at 6:58
Check this : stackoverflow.com/questions/34673836/…
– Mohammadreza Khatami
Nov 21 '18 at 8:25
Check this : stackoverflow.com/questions/34673836/…
– Mohammadreza Khatami
Nov 21 '18 at 8:25
Possible duplicate of Disable HTTPSession for stateless web services
– Alan Hay
Nov 21 '18 at 9:02
Possible duplicate of Disable HTTPSession for stateless web services
– Alan Hay
Nov 21 '18 at 9:02
add a comment |
1 Answer
1
active
oldest
votes
0
You can do this in your implementation of the WebSecurityConfigurerAdapter by setting the SessionCreationPolicy to STATELESS:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
answered Nov 21 '18 at 10:14
TomTom
546213
But I don't have Spring Security in my project.
– Amir Pashazadeh
Dec 8 '18 at 1:13
add a comment |
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53406486%2fhow-to-prevent-creating-httpsession-in-spring-rest-controller%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
0
You can do this in your implementation of the WebSecurityConfigurerAdapter by setting the SessionCreationPolicy to STATELESS:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
answered Nov 21 '18 at 10:14
TomTom
546213
But I don't have Spring Security in my project.
– Amir Pashazadeh
Dec 8 '18 at 1:13
add a comment |
0
You can do this in your implementation of the WebSecurityConfigurerAdapter by setting the SessionCreationPolicy to STATELESS:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
answered Nov 21 '18 at 10:14
TomTom
546213
But I don't have Spring Security in my project.
– Amir Pashazadeh
Dec 8 '18 at 1:13
add a comment |
0
0
0
You can do this in your implementation of the WebSecurityConfigurerAdapter by setting the SessionCreationPolicy to STATELESS:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
answered Nov 21 '18 at 10:14
TomTom
546213
You can do this in your implementation of the WebSecurityConfigurerAdapter by setting the SessionCreationPolicy to STATELESS:
@Override
protected void configure(HttpSecurity http) throws Exception {
http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS);
}
answered Nov 21 '18 at 10:14
TomTom
546213
answered Nov 21 '18 at 10:14
TomTom
546213
answered Nov 21 '18 at 10:14
TomTom
546213
answered Nov 21 '18 at 10:14
TomTom
546213
546213
But I don't have Spring Security in my project.
– Amir Pashazadeh
Dec 8 '18 at 1:13
add a comment |
But I don't have Spring Security in my project.
– Amir Pashazadeh
Dec 8 '18 at 1:13
But I don't have Spring Security in my project.
– Amir Pashazadeh
Dec 8 '18 at 1:13
But I don't have Spring Security in my project.
– Amir Pashazadeh
Dec 8 '18 at 1:13
add a comment |
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53406486%2fhow-to-prevent-creating-httpsession-in-spring-rest-controller%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
see stackoverflow.com/questions/22817012/…
– Scary Wombat
Nov 21 '18 at 6:43
I think the answer is not correct, an HTTPSession must not be created if you don't ask the server to do it. In normal JSP/Servlet (and many other frameworks) it is default to create an HTTPSession, but in REST Application it is not.
– Amir Pashazadeh
Nov 21 '18 at 6:54
Please back that up with a source
– Scary Wombat
Nov 21 '18 at 6:58
Check this : stackoverflow.com/questions/34673836/…
– Mohammadreza Khatami
Nov 21 '18 at 8:25
Possible duplicate of Disable HTTPSession for stateless web services
– Alan Hay
Nov 21 '18 at 9:02