title: Spring adds a JSESSIONID despite stateless session management
body: <p>I am using a working JWT authentication of my web application with the following configuration:</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
        .csrf().disable()
        .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS)
        .and()
        .exceptionHandling()
        .authenticationEntryPoint(
            (req, rsp, e) -&gt; p.sendError(HttpServletResponse.SC_UNAUTHORIZED))
        .and()
        .addFilter(new UsernamePasswordAuthenticationFilter(authenticationManager(),
            jwtConfig))
        .addFilterAfter(new JwtTokenAuthenticationFilter(jwtConfig),
            UsernamePasswordAuthenticationFilter.class)
        .authorizeRequests()
        .antMatchers(HttpMethod.POST, jwtConfig.getUri()).permitAll()
        .anyRequest().authenticated();
  }
  </code></pre>
  
  <p>As of <code>SessionCreationPolicy.STATELESS</code> i am expecting that Spring will not create a session itself. However, if i access any other resource than <code>/login</code>, i still see the following entry in the response header:</p>
  
  <pre><code>set-cookie: JSESSIONID=...; Path=/; HttpOnly
  </code></pre>
  
  <p>Can someone explain where this is coming from (maybe not from Spring) and if it does still come from Spring what needs to be changed?</p>
  
  <p><strong>Edit:</strong></p>
  
  <p>Testing in my controller, the session is still injected as indicated by the above token being present. I still have no clue where this is coming from.</p>
  
  <pre><code>@PostMapping
  @ResponseStatus(HttpStatus.CREATED)
  public void create(HttpSession session) {
      if (session != null) {
          System.out.println("Session is existing"); // executes
      }
  }
  </code></pre>