title: Keycloak and Spring Boot: session creation policy
body: <p>I try to configure keycloak with Spring Boot amd I would like to use custom Keycloak login page for getting acess token. Then I would like to pass this token to rest endpoints in my microservices. My Spring application is running on port 8081. I set up in keycloak admin console valid redirect as <code>http://localhost:8081/*</code>. Now during redirectin after login jsessionid is added to url (it looks like this <code>http://localhost:8081/;jsessionid=session_id</code>) and I am getting exception:</p>
  
  <pre><code>org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String ";"
  </code></pre>
  
  <p>After removal from Spring security configuration <code>sessionCreationPolicy(SessionCreationPolicy.STATELESS)</code> it is redirected to valid url but <code>KEYCLOAK_IDENTITY</code> and <code>KEYCLOAK_SESSION</code> is not set in browser storage. I would like to as why does it work this way and what is proper way to configure it?</p>
  
  <p>Part of my Spring security config:</p>
  
  <pre><code>  @Override
    protected void configure(HttpSecurity http) throws Exception {
      super.configure(http);
      http.
          csrf().disable()
          .sessionManagement()
          .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
          .sessionAuthenticationStrategy(sessionAuthenticationStrategy())
          .and()
          .authorizeRequests()
          .anyRequest()
          .fullyAuthenticated();
    }
  </code></pre>