title: How does Spring Security handle JSESSIONID with various Session Creation and Session Fixation combinations?
body: <p>I have a J2EE REST-based app using Spring Security 4.0.1.RELEASE. Needless to say, Spring documentation on <code>sessionCreationPolicy</code> and <code>sessionFixation</code> is sparse, aside from targeted questions here on StackOverflow.</p>
  
  <p>I'm using a Java-based config for Spring Security like this:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  @EnableGlobalMethodSecurity(secureEnabled=true, prePostEnabled=true, jsr250Enabled=true, order=1)
  public class DefaultSecurityBeansConfig extends WebSecurityConfigurerAdapter {
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          http.sessionManagement()
              .sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED)
              .sessionFixation().migrateSession()
              .and()...; // additional config omitted for brevity
      }
  }
  </code></pre>
  
  <p>I'd really just like to know what behavior to expect from Spring, as it relates to <code>JSESSIONID</code>, given all possible combinations of <code>sessionCreationPolicy</code> and <code>sessionFixation</code>.</p>
  
  <p>Possible values in the <code>SessionCreationPolicy</code> enum are <code>ALWAYS</code>, <code>NEVER</code>, <code>IF_REQUIRED</code>, and <code>STATELESS</code>.</p>
  
  <p>Possible values for session fixation are <code>newSession</code>, <code>migrateSession</code>, <code>changeSessionId</code>, and <code>none</code>.</p>
  
  <p>Thank you.</p>
  
  <p><strong>NOTE</strong>: What prompted this question is that I am <em>not</em> seeing a new <code>JSESSIONID</code> on every request when I have <code>sessionCreationPolicy</code> set to <code>IF_REQUIRED</code> and <code>sessionFixation</code> set to <code>changeSessionId</code>. A <code>JSESSIONID</code> is correctly created, but is maintained across requests thereafter. I generalized my question about all combinations to hopefully help others in a similar situation with slightly different settings.</p>