title: How to stop Spring Security from creating a new session?
body: <h3>Scenario</h3>
  
  <ol>
  <li>I restart the server and browser so there's no session data.</li>
  <li>I go to www.someurl.com public access page. My controller gets me a session with this <code>HttpSession session=request.getSession(true);</code></li>
  <li>I click on a plane anchor link to www.someurl.com/admin restricted access page which opens in a new tab. Spring Security 3 intercepts this and challenges for credentials. I log in successfully.</li>
  <li>I go back to the previous tab with www.someurl.com and refresh the page. </li>
  </ol>
  
  <h3>Problem</h3>
  
  <p>What I notice in my controller for www.someurl.com is that the session id is different on step 2 and step 4. Looks like Spring Security created a new session and that session is now attached to the request for public page. Why does this happen and can I force Spring Security to use existing session?  </p>
  
  <h3>Traced scenario</h3>
  
  <ol>
  <li>Restart browser and server so no session data exist(s).</li>
  <li>I go to www.someurl.com. Controller has request injected. request.session is null. getSession(true) gets me a session with id 87B091B12F38D44C53AF0DA9E2147484. LogService gets the request object and also does getSession(true) but gets session with id 87B091B12F38D44C53AF0DA9E2147484 so all's good thus far.</li>
  <li>I click /admin. Page opens up in new tab. I log in.</li>
  <li>I refresh the www.someurl.com. Controller has request injected. request.session is not null. Session id is 547DF59035C91783D783BAEF4A15FBFF.</li>
  </ol>