1

I want to set SessionCreationPolicy.STATELESS but sessionManagement() is deprecated and marked for removal. How can I set it?

The deprecated method is below:

@Bean
SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {

   http.authorizeHttpRequests((requests) -> requests.anyRequest().authenticated());

   http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)

   http.authenticationProvider(authenticationProvider());

   return http.build();
}

deprecated message

ylmzzsy
  • 7
  • 2

2 Answers2

1

As mentioned in the docs and official examples, you should use Customizer approach, like:

@Bean
  public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
    return http
        .authorizeHttpRequests(requests -> requests.anyRequest().permitAll())
        .httpBasic(Customizer.withDefaults())
        .csrf(AbstractHttpConfigurer::disable)
        .sessionManagement(session -> session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
        .headers(headers -> headers.frameOptions(HeadersConfigurer.FrameOptionsConfig::disable))
        .build();
  }
Irremediable
  • 94
  • 6
1

I also ran into this problem.

In Spring Security 6.0, antMatchers() as well as other configuration methods for securing requests (namely mvcMatchers() and regexMatchers()) have been removed from the API.

The solution to this problem is in this topic.

Hikko
  • 11
  • 1