title: Spring Security sessionID as token configuration
body: <p>I am implementing a login process using Spring Security + Spring session to build login functionality for a REST like backend service that needs to create/mantain a session.</p>
  
  <p>I am not sure if I am approaching the solution the right way since I am using a custom endpoint to create the session manually.  Maybe the session creation needs to be done in the Authorization method itself? Or maybe there is a way to have spring create the session after some request validations in the backend? I am using a custom filter and provider for this.</p>
  
  <p>Also with my current configuration, I am having an issue since the backend API is creating a new session with every request, even when it should return 401.</p>
  
  <p>The requirements of this solution is as follows:</p>
  
  <ol>
  <li>The clients will login to a third party authentication/authorization provider.  Once validated, the provider will issue an access token.</li>
  <li>The API must validate the client's access token with the third party provider.  Once validated, the API must create a session and return a new token (or sessionID) to the clients.</li>
  <li>Future calls to the API should include the token (or sessionID) in the header/cookie so the API gets the session of the client.</li>
  </ol>
  
  <p><strong>The big question here is:</strong>  Is there a common approach to follow for using token based authentication linked to a user session?  If so, what if I need to do custom validations before having spring session create the session, and also add custom attributes to this session?</p>
  
  <p>My code is located here: <a href="https://github.com/munilvc/api-session/tree/master/src/main/java/com/munilvc/poc/security" rel="nofollow noreferrer">https://github.com/munilvc/api-session/tree/master/src/main/java/com/munilvc/poc/security</a></p>
  
  <p>For instance, some sample executions:</p>
  
  <p>1) Execute custom login:</p>
  
  <pre><code>$ curl -X POST http://localhost:8080/app-api/login/createsession -v
  &gt; POST /app-api/login/createsession HTTP/1.1
  &gt; Host: localhost:8080
  &gt; User-Agent: curl/7.49.1
  &gt; Accept: */*
  &gt;
  &lt; HTTP/1.1 200
  &lt; x-auth-token: 15a06ce8-5b34-401a-a05f-a0d933926245
  &lt; Content-Type: application/json;charset=UTF-8
  &lt; Transfer-Encoding: chunked
  &lt; Date: Tue, 29 Aug 2017 01:28:24 GMT
  &lt;
  171{"username":"username1"}
  </code></pre>
  
  <p>2) Call another endpoint with provided x-auth-token:</p>
  
  <p>NOTE the x-auth-token is refreshed in the response. (means a new session is created - This is what we want to avoid, this also happens when response is 401)</p>
  
  <pre><code>$ curl -X GET http://localhost:8080/app-api/accounts/2 -H "x-auth-token:15a06ce8-5b34-401a-a05f-a0d933926245" -v
  &gt; GET /app-api/accounts/2 HTTP/1.1
  &gt; Host: localhost:8080
  &gt; User-Agent: curl/7.49.1
  &gt; Accept: */*
  &gt; x-auth-token:15a06ce8-5b34-401a-a05f-a0d933926245
  &gt;
  &lt; HTTP/1.1 200
  &lt; X-Content-Type-Options: nosniff
  &lt; X-XSS-Protection: 1; mode=block
  &lt; Cache-Control: no-cache, no-store, max-age=0, must-revalidate
  &lt; Pragma: no-cache
  &lt; Expires: 0
  &lt; X-Frame-Options: DENY
  &lt; x-auth-token: 42a5db80-e5e1-4127-bd85-e468af4a8fb2
  &lt; Content-Type: application/json;charset=UTF-8
  &lt; Transfer-Encoding: chunked
  &lt; Date: Tue, 29 Aug 2017 01:29:08 GMT
  &lt;
  870{"id":3,"name":"Account 3"}
  </code></pre>
  
  <p>PS: I am not sure if I am allowed to provide a link to the code in stack overflow.  If not, I can paste the code here as well.</p>
  
  <p>Thank you very much!</p>