Spring MVC with Thymeleaf without creating a session

Question

Let's say I'm using Spring MVC with Thymeleaf with an HTML page foo that submits text to bar using HTTP POST from a standard HTML form. I have a BarController that looks something like this:

@Controller
@RequestMapping("/bar")
public class BarController {

  @PostMapping(consumes = MediaType.APPLICATION_FORM_URLENCODED_VALUE)
  public String postText(@RequestParam("text") String text, final Model model) {
    model.addAttribute("submittedText", text);
    return "/bar";
  }

Then my view Thymeleaf template file does something with $submittedText. For example it could place the text in the HTML:

<p>Submitted text: <span th:text="${submittedText}"></span></p>

Can I use Spring MVC and Thymeleaf in this way as a simple model/view templating system (i.e. a layer on top of manually writing servlets), without any back-end session being created?

I think the answer is "yes", but I wanted to run it by the other Spring MVC and Thymeleaf experts to make sure.

My understanding is that Spring MVC uses Java EE servlet sessions, and a session is not created until request.getSession() or request.getSession(true) is called. If I'm not declaring any session variables, and I'm not declaring any flash attributes, and I'm delegating directly to the view without redirecting, then there is no need for a session and Spring would never attempt to retrieve one. I presume this scenario would be no different than if I simply wrote a servlet from scratch to look at the submitted data and generate HTML by string concatenation.

Furthermore I have used Chrome Developer Tools and don't see any session cookie or URL rewriting taking place with a session ID.

I am keen to know if a session is getting created somewhere I'm not knowing about, or any other gotchas I should watch out for.

Answer 1

Theoretically you're right. Unless you explicitly create a session (using request.getSession() or request.getSession(true) or any other way), you are not creating a session, thus the main symptom of a session (which is the JSESSIONID cookie) wouldn't be available.

I say "theoretically" because, although you are not creating a session, other parts of your code might create a session based on what you're trying to do, which to me doesn't look like the case here.

As you're using Spring, if you're also using Spring Security, you can disable the session altogether - if that's your choice - by using/customizing the SecurityFilterChain bean, like this (the following code considers you're using Spring Security 6):

@Bean
public SecurityFilterChain filterChain(HttpSecurity http) {
    http
        // ...
        .sessionManagement((session) -> session
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        );
    return http.build();
}

Also, take a look at how Spring handles the SessionCreationPolicy and what each option (STATELESS, NEVER...) does.

Examples for older versions are also available at the source, but they aren't deviating that far from this one.