title: Spring Session and Spring Security
body: <p>I have questions on the following areas: spring-session and spring-security.</p>
  <h1>Spring Session</h1>
  <p>I have a application protected with Spring Security through basic in-memory authentication as provided in the example sample.</p>
  <p>I see spring is creating session id's even the authentication is not successful, meaning I am seeing <code>x-auth-token</code> in my response header as well in the Redis DB even if I don't supply basic authentication credential details.
  How do we avoid creating sessions for authentication failures?</p>
  <h1>Spring Security</h1>
  <p>Want to use spring security to protect resources assuming spring session creates session only for the protected resources.</p>
  <p>Assuming a Signin API (/signin - HTTP Post) validates (username &amp; password) credentials against a third-party REST API .</p>
  <p>Once the external API validates the credentials, how do I update the spring security context on the successful authentication?</p>
  <p>Access to other secured resources with the <code>x-auth-token</code> needs to be validated and based on the information access to the secured resource should be provided.</p>
  <p>Do we need to have Spring Security in this case or shall I use a basic filter and spring session? What is recommended?</p>