Set Tracking Mode to Cookie to Remove Appended Session Id, Without Using Web. Xml
I Am Setting up a Completely Java Based Spring App with No Xml Config: Public Class Webapp Extends Abstractannotationconfigdispatcherservletinitializer {...
I am setting up a completely java based spring app with no xml config :
public class WebApp extends AbstractAnnotationConfigDispatcherServletInitializer {
@Override
protected Class<?>[] getRootConfigClasses() {
return null;
}
@Override
protected Class<?>[] getServletConfigClasses() {
return new Class<?>[]{WebMvcConfigurer.class};
}
@Override
protected String[] getServletMappings() {
return new String[]{"/"};
}
and
@Configuration
@EnableWebMvc
@ComponentScan(basePackages = { mypackages })
public class WebMvcConfigurer extends WebMvcConfigurerAdapter {
@Override
public void addResourceHandlers(ResourceHandlerRegistry registry) {
registry.addResourceHandler("/resources/**").addResourceLocations("/static-assets/");
}
@Bean
public ViewResolver viewResolver() {
InternalResourceViewResolver viewResolver = new InternalResourceViewResolver();
viewResolver.setViewClass(JstlView.class);
viewResolver.setPrefix("/WEB-INF/views/");
viewResolver.setSuffix(".jsp");
return viewResolver;
}
where do I put this, which used to be in my web.xml ?
<session-config>
<!-- Disables URL-based sessions (no more 'jsessionid' in the URL using Tomcat) -->
<tracking-mode>COOKIE</tracking-mode>
</session-config>
5 Answers
you can do it as in below
public class WebConfig implements WebApplicationInitializer {
@Override
public void onStartup(ServletContext servletContext)
throws ServletException {
HashSet<SessionTrackingMode> set = new HashSet<SessionTrackingMode>();
set.add(SessionTrackingMode.COOKIE);
servletContext.setSessionTrackingModes(set);
}
}
In a Spring Boot app, you can configure the mode using the application property server.session.tracking-modes.
In your application.properties add:
server.session.tracking-modes=cookie
Or if you use application.yml:
server:
session:
tracking-modes: 'cookie'
The Spring Boot autoconfiguration internally uses the same call to servletContext.setSessionTrackingModes which Bassem recommended in his answer.
UPDATE
In newer versions of Springboot, use
server.servlet.session.tracking-modes=cookie
Since 3.2.0.RC1 this is available in the AbstractSecurityWebApplicationInitializer like so:
public class WebSecutityInit extends AbstractSecurityWebApplicationInitializer {
@Override
protected Set<SessionTrackingMode> getSessionTrackingModes() {
return EnumSet.of(SessionTrackingMode.SSL);
}
}
As of spring boot 2.4.0 and later, the application property is renamed to server.servlet.session.tracking-modes.
So, in application.properties, need to add
server.servlet.session.tracking-modes="cookie"
If using application.yml, need to have
server:
servlet:
session:
tracking-modes: cookie
Another solution, that works for me, has been the code below inside the SecurityConfig class.
@Override
protected void configure(HttpSecurity http) throws Exception {
http.httpBasic()
.and()
.sessionManagement()
.sessionCreationPolicy(SessionCreationPolicy.STATELESS) //No sessionId eppended
...
}
Elena Rostova holds a Master's degree in Public Health Journalism. She covers groundbreaking medical research, holistic wellness trends, mental health awareness, and nutritional science.
