title: How to manage session with spring security based on request type?
body: <p>I would like to configure web security layer based on my request type.</p>
  
  <p>If the request starts with <strong>/rest</strong> then it should use Basic authentication with stateless session management and for login authentication then it should use CSRF with stateful session management.</p>
  
  <p>I have tried below code.</p>
  
  <pre class="lang-java prettyprint-override"><code>@Override
  protected void configure(HttpSecurity http) throws Exception 
  {
      http
          .authorizeRequests()
          .antMatchers("/rest/**").hasRole("SUPER_ADMIN") 
          .anyRequest().fullyAuthenticated()
          .and()
          .sessionManagement()
          .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
          .and()
          .httpBasic()
          .authenticationEntryPoint(authenticationEntryPoint)
          .and()
          .formLogin().and().logout().permitAll();
  }
  </code></pre>
  
  <p>It works with basic authentication but it doesn't work for the login request because the session is not stateful. Can anyone please help me to configure Spring security. I am new to Spring security.</p>