Search code examples
springspring-securityload-balancingamazon-ec2

How can I use Spring Security without sessions?

I am building a web application with Spring Security that will live on Amazon EC2 and use Amazon's Elastic Load Balancers. Unfortunately, ELB does not support sticky sessions, so I need to ensure my application works properly without sessions.

So far, I have setup RememberMeServices to assign a token via a cookie, and this works fine, but I want the cookie to expire with the browser session (e.g. when the browser closes).

I have to imagine I'm not the first one to want to use Spring Security without sessions... any suggestions?

Solution

  • It seems to be even easier in Spring Securitiy 3.0. If you're using namespace configuration, you can simply do as follows:

    <http create-session="never">
  <!-- config -->
</http>

    Or you could configure the SecurityContextRepository as null, and nothing would ever get saved that way as well.