title: Spring Security Oauth2 generating jsessiond even when create-session="stateless" is used
body: <p>I am using Spring Security Oauth2  for authentication purpose in my application which is stateless . Below is the code snippet of spring config file<br>
  Also I have used <code>&lt;%@ page session="false" %&gt;</code> in all jsps. </p>
  
  <pre><code>&lt;http pattern="/oauth/token" create-session="stateless"
      authentication-manager-ref="clientAuthenticationManager"
      xmlns="http://www.springframework.org/schema/security"&gt;
      &lt;intercept-url pattern="/oauth/token" access="IS_AUTHENTICATED_FULLY" /&gt;
      &lt;anonymous enabled="false" /&gt;
      &lt;http-basic entry-point-ref="clientAuthenticationEntryPoint" /&gt;
      &lt;!-- include this only if you need to authenticate clients via request --&gt;
      &lt;!-- parameters --&gt;
      &lt;custom-filter ref="clientCredentialsTokenEndpointFilter"
          after="BASIC_AUTH_FILTER" /&gt;
      &lt;access-denied-handler ref="oauthAccessDeniedHandler" /&gt;
  &lt;/http&gt;
  
  &lt;http auto-config="true" create-session="stateless"&gt;
      &lt;intercept-url pattern="/oauth/**" access="ROLE_USER" /&gt;
      &lt;intercept-url pattern="/welcome*" access="ROLE_USER" /&gt;
      &lt;intercept-url pattern="/test" access="ROLE_USER" /&gt;
      &lt;form-login login-page="/login" default-target-url="/welcome"
          authentication-failure-url="/loginfailed"
          authentication-success-handler-ref="customAuthenticationSuccessHandler" /&gt;
      &lt;logout logout-success-url="/logout" /&gt;
      &lt;custom-filter ref="preAuthFilter" after="PRE_AUTH_FILTER" /&gt;
      &lt;custom-filter ref="oauth2ClientFilter" after="EXCEPTION_TRANSLATION_FILTER" /&gt;
  &lt;/http&gt;`
  </code></pre>
  
  <p>Also I have created my own Authorization End point(/authorizeTest) as the one provided by Ouath2(/oauth/authorize) is putting AuthorizationRequest as session Attribute. Following is the code snippet for CustomAuthorizationEndPoint </p>
  
  <pre><code>&lt;beans:bean id="customAuthorizationEndpoint"
      class="com.mkyong.common.controller.CustomAuthorizationEndpoint"&gt;
      &lt;beans:property name="tokenGranter" ref="authorizationCodeTokenGranter" /&gt;
      &lt;beans:property name="clientDetailsService" ref="clientDetails" /&gt;
      &lt;beans:property name="oAuth2RequestFactory" ref="customOAuth2RequestFactory" /&gt;
      &lt;beans:property name="authorizationCodeServices"
          ref="inMemoryAuthorizationCodeServices" /&gt;
      &lt;beans:property name="dataSource" ref="dataSource" /&gt;
  &lt;/beans:bean&gt;
  &lt;beans:bean id="authorizationCodeTokenGranter"
      class="org.springframework.security.oauth2.provider.code.AuthorizationCodeTokenGranter"&gt;
      &lt;beans:constructor-arg index="0" ref="tokenServices" /&gt;
      &lt;beans:constructor-arg index="1"
          ref="authorizationCodeServices" /&gt;
      &lt;beans:constructor-arg index="2" ref="clientDetails" /&gt;
      &lt;beans:constructor-arg index="3"
          ref="customOAuth2RequestFactory" /&gt;
  &lt;/beans:bean&gt;
  
  
  &lt;beans:bean id="customOAuth2RequestFactory"
      class="com.mkyong.common.controller.CustomOAuth2RequestFactory"&gt;
      &lt;beans:constructor-arg ref="clientDetails" /&gt;
      &lt;beans:property name="dataSource" ref="dataSource" /&gt;
      &lt;beans:property name="customAuthorizationRequest" ref="customAuthorizationRequest" /&gt;
  &lt;/beans:bean&gt;
  
  &lt;beans:bean id="customAuthorizationRequest"
      class="com.mkyong.common.controller.CustomAuthorizationRequest"&gt;
  &lt;/beans:bean&gt;
  
  
  &lt;beans:bean id="authorizationCodeServices"
      class="org.springframework.security.oauth2.provider.code.JdbcAuthorizationCodeServices"&gt;
      &lt;beans:constructor-arg ref="dataSource" /&gt;
  
  &lt;/beans:bean&gt;
  </code></pre>
  
  <p>But still I am getting jsession generated.</p>