title: Spring Boot Basic Authentication without Session (Stateless Session)
body: <p>I have configured Basic Authentication my Spring-Boot application. Everything is Java Config, no xml.</p>
  
  <pre><code>import org.springframework.context.annotation.Configuration;
  import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
  import org.springframework.security.config.annotation.web.builders.HttpSecurity;
  import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
  import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter;
  
  @Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(AuthenticationManagerBuilder auth) throws Exception {
          // Authenticate username -&gt; admin, password -&gt; admin &amp; set role as "ROLE_USER"
          auth.inMemoryAuthentication().withUser("admin").password("admin").roles("USER");
      }
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
  
          http.authorizeRequests()
              .antMatchers("/login").permitAll()
              // All Requests should be Authenticated
              .anyRequest().authenticated()
              .and()
              // Enable Basic Authentication
              .httpBasic()
              .and()
              .formLogin()
                  .loginPage("/login")
                  .defaultSuccessUrl("/main", true)
                  .loginProcessingUrl("/session")
                  .usernameParameter("Username").passwordParameter("Password")
              .and()
              .logout().logoutUrl("/logout").permitAll()
              .and().csrf().disable();
      }
  
  }
  </code></pre>
  
  <p>It's configured for both Basic authentication and normal form login. When I tested the basic authentication from Rest-Client on Firefox, I can access the secure url "/main". But in the response headers, I'm getting <code>Set-Cookie: JSESSIONID=301225C7AE7C74B0892887389996785D;</code>.</p>
  
  <p>I don't want cookies to be generated for basic authentication. I want true <code>Stateless session</code> for Basic Authentication. Do note that I need cookies to be generated for form-login to work, so disabling cookies is not an option. I know about the <code>create-session="stateless"</code> in xml configuration, but is there any way to do the same in Java config so that Basic Authentication is Stateless and Form-Authentication is Statefull..?</p>