GitHub

CSRF protection should not create a HTTP session if session creation policy is set to STATELESS

@Bean public WebSecurityConfigurerAdapter webSecurityConfigurerAdapter() { return new WebSecurityConfigurerAdapter() { @Override protected void configure(HttpSecurity ...