Keep session id in case of presence of special parameter in request. Spring Security

Question

Does anybody know if there any way to configure Spring Security in the way that it doesn't change session id if there is some parameter in the request.

For example:

• somesite.com/home.jsp?password=encrypted- change session id after authentication

• somesite.com/home.jsp?password=encrypted& keepsessionid - don't change session id after authentication

I was thinking about filter chain, maybe removing conditionally SessionManagementFilter, but not sure if this is a proper way, and even if this will be working

Answer 1

For someone with the same question. I found the answer. Different session management strategy can be achieved by using multiple http security configuration (inner classes of main security classes). The special case http security configurer should be adjusted to some special request

@Configuration
@Order(1)
public class SpecialCaseSessionHandlingConfig extends WebSecurityConfigurerAdapter {
    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.requestMatcher(request -> Check1(request))
            .authorizeRequests()
            .anyRequest().authenticated();
    }
}