title: How to prevent creating HttpSession in Spring REST Controller
body: <p>In our project we have implemented a few REST Services using Spring <code>@RestController</code>. The problem is when I test them using a REST Client, in response header there exists <code>JSESSIONID</code>, So I believe the server creates an <code>HTTPSession</code> for each request, but the services are stateless and they don't need <code>HTTPSession</code>.</p>
  
  <p>Is there any way to prevent creating new sessions in this controllers?</p>
  
  <hr>
  
  <p>This is the source of RestController</p>
  
  <pre><code>@RestController
  @RequestMapping("/customs/customs")
  public class CustomsRestController {
  
      @Autowired
      private CustomsWebService customsWebService;
  
      @Autowired
      private CustomsSecurityContextInitializer securityContextInitializer;
  
      @RequestMapping(path = "/customsPorts", method = RequestMethod.GET,
              consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
              produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
      public Collection&lt;CustomsPort&gt; getActiveCustomsPorts() {
          try {
              securityContextInitializer.initSecurityContext();
              return customsWebService.getActiveCustomsPorts();
          } finally {
              securityContextInitializer.clearSecurityContext();
          }
      }
  
      @RequestMapping(path = "/registerCustomsRequest", method = RequestMethod.POST,
              consumes = MediaType.APPLICATION_JSON_UTF8_VALUE,
              produces = MediaType.APPLICATION_JSON_UTF8_VALUE)
      public CustomsDeclarationInfo registerCustomsRequest(@RequestBody CustomsDeclarationRequest requestKey) {
          try {
              securityContextInitializer.initSecurityContext();
              requestKey.validate();
              return customsWebService.registerCustomsRequest(requestKey);
          } catch (BusinessException e) {
              return CustomsDeclarationInfo.builder().errorMessage(e.getMessage()).build();
          } finally {
              securityContextInitializer.clearSecurityContext();
          }
      }
  
  }
  </code></pre>