title: Stateless spring security oauth2 provider
body: <p>I want to setup a simple OAuth2 provider based on spring-boot, spring-security and spring-oauth2.</p>
  
  <p>I got everything working on a single instance machine: For an OAuth2 authorization, the user is sent to <code>/oauth/authorize</code>. Most user's are not logged in so they are redirected to <code>/login</code> by spring security and  then back t <code>/oauth/authorize</code> to finish the authorization.</p>
  
  <p>In the default configuration, spring-security sets a cookie in the user's browser with a session-id and stores session data in-memory.</p>
  
  <pre><code>public static class SecurityConfiguration extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http
              .authorizeRequests()
              .and()
              .formLogin()
              .loginPage("/login")
              .permitAll();
      }
  [...]
  </code></pre>
  
  <p>In order to enable load-balancing and blue-green deployments without loosing user sessions, (I think) I have to perform the following steps:</p>
  
  <ul>
  <li>Disable server side sessions - for an API that is only responsible for OAuth2 authorization I don't think it is necessary to have a shared database for sessions.</li>
  <li>Instead, Enable a remember-me cookie containing the user authentication, temporariliy during authorization.</li>
  <li>Store the redirect url for the <code>/login</code> redirect at a different place
  
  <ul>
  <li>Is it possible to store this in the login form or user cookie? Or what would be an "sessionless" alternative?</li>
  </ul></li>
  <li>Disable CSRF (I know how to do that and oauth2 has auth_codes which I think have a similar purpose. Just for completeness.)</li>
  </ul>
  
  <p>Does that approach make sense? What changes are necessary?</p>