{"id":1572,"date":"2012-07-06T16:00:00","date_gmt":"2012-07-06T16:00:00","guid":{"rendered":"http:\/\/www.javacodegeeks.com\/2012\/10\/rest-spring-security-session-problem.html"},"modified":"2012-10-22T06:08:24","modified_gmt":"2012-10-22T06:08:24","slug":"rest-spring-security-session-problem","status":"publish","type":"post","link":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html","title":{"rendered":"REST + Spring Security session problem"},"content":{"rendered":"<div dir=\"ltr\" style=\"text-align: left\"><strong>REST<\/strong>, <strong>sessions<\/strong> .. wait. There are no sessions in REST application, right? Well, thats true. If we can avoid sessions we should do that. REST is <strong>stateless<\/strong>. The main concern about statelessness is authentication. In usual web applications we were used to store user data in session after authentication. How to solve that if we don\u2019t want to use sessions? We should <a href=\"http:\/\/appsandsecurity.blogspot.com\/2011\/04\/rest-and-stateless-session-ids.html\">authenticate every request<\/a>.<\/p>\n<p>Thanks to that we can scale our application, add new nodes, remove nodes without care about session replication and also about consumed Java heap memory.         <\/p>\n<p>Recently I\u2019ve been working on high load REST application. Actually we didn\u2019t expect to have high traffic there but surprisingly we had much much higher that we have been prepared for (it\u2019s so called \u201chappy problem\u201d). Application is based on <a href=\"http:\/\/www.springsource.org\/\">Spring Framework<\/a> and its secured with <a href=\"http:\/\/www.springsource.org\/spring-security\">Spring Security<\/a> deployed on <a href=\"http:\/\/tomcat.apache.org\/\">Apache Tomcat 7<\/a>. All resources are totally stateless \u2013 HttpSession is not touched by any piece of my code. Unfortunately used <strong>Java heap space<\/strong> was increasing all the time until:          <\/p>\n<pre class=\"brush:java\">java.lang.OutOfMemoryError: Java heap space<\/pre>\n<p>was thrown. In order to analyze Java heap dump and runtime usage of heap I used <a href=\"http:\/\/visualvm.java.net\/\">VisualVM<\/a>.<div style=\"display:inline-block; margin: 15px 0;\"> <div id=\"adngin-JavaCodeGeeks_incontent_video-0\" style=\"display:inline-block;\"><\/div> <\/div><\/p>\n<div class=\"separator\" style=\"clear: both;text-align: center\"><a href=\"http:\/\/4.bp.blogspot.com\/-vzx5hyKnu9U\/T_ahRkdSj4I\/AAAAAAAAA6Y\/qMoeEM6vEYo\/s1600\/Screen-Shot-2012-07-04-at-10.05.png\"><img decoding=\"async\" border=\"0\" height=\"238\" src=\"http:\/\/4.bp.blogspot.com\/-vzx5hyKnu9U\/T_ahRkdSj4I\/AAAAAAAAA6Y\/qMoeEM6vEYo\/s400\/Screen-Shot-2012-07-04-at-10.05.png\" width=\"400\" \/><\/a><\/div>\n<p>Heap dump analysis shown that big part of memory was used by ConcurrentHashMaps used by <strong>Tomcat<\/strong> to store sessions. Those sessions object were almost empty but there were so many of them that they consumed ~50% of reserved Java heap space.<\/p>\n<div class=\"separator\" style=\"clear: both;text-align: center\"><a href=\"http:\/\/3.bp.blogspot.com\/-8C2yd9pBU7E\/T_aheD3lNWI\/AAAAAAAAA6g\/j-PIlDZcl5k\/s1600\/Screen-Shot-2012-07-05-at-13.55.51.png\"><img decoding=\"async\" border=\"0\" height=\"347\" src=\"http:\/\/3.bp.blogspot.com\/-8C2yd9pBU7E\/T_aheD3lNWI\/AAAAAAAAA6g\/j-PIlDZcl5k\/s400\/Screen-Shot-2012-07-05-at-13.55.51.png\" width=\"400\" \/><\/a><\/div>\n<p>Add parameter to Tomcat startup script: <strong><code>-XX:+HeapDumpOnOutOfMemoryError<\/code><\/strong> to get <strong>Java heap dump<\/strong> on <code>java.lang.OutOfMemoryError: Java heap space<\/code><br \/>\nFirst thing that I\u2019ve done was to limit session timeout from default 30 minutes to 1 minute (lowest possible option) in <code>web.xml<\/code>:         <\/p>\n<pre class=\"brush:xml\">&lt;?xml version='1.0' encoding='UTF-8'?&gt;\r\n&lt;web-app xmlns='http:\/\/java.sun.com\/xml\/ns\/javaee'\r\n         xmlns:xsi='http:\/\/www.w3.org\/2001\/XMLSchema-instance'\r\n         xsi:schemaLocation='http:\/\/java.sun.com\/xml\/ns\/javaee\r\n\r\nhttp:\/\/java.sun.com\/xml\/ns\/javaee\/web-app_3_0.xsd'\r\n\r\n         version='3.0'&gt;\r\n    &lt;!-- ... --&gt;\r\n\r\n    &lt;session-config&gt;\r\n        &lt;session-timeout&gt;1&lt;\/session-timeout&gt;\r\n    &lt;\/session-config&gt;\r\n&lt;\/web-app&gt;<\/pre>\n<p>That solved the problem \u2013 heap was cleaned by GC with better results and OutOfMemoryError was not thrown anymore. But more important thing is where those sessions were coming from? The answer is: Spring Security.          <\/p>\n<p>By default Spring Security creates sessions <strong>if required<\/strong> \u2013 which means that if user has authenticated successfully then session is created. In my case it meaan \u2013 always. In order to prevent Spring Security from creating sessions <code>create-session='never'<\/code> needs to be added to <code>http<\/code>:         <\/p>\n<pre class=\"brush:xml\">&lt;http create-session='never'&gt;\r\n    &lt;!-- ... --&gt;\r\n&lt;\/http&gt;<\/pre>\n<p>You might think \u2013 empty session objects should not be a problem. I can tell you that for application handling few hundreds of requests per second it does a real change. Especially when its not running in the cloud or has few GB or RAM memory dedicated for Java heap. That\u2019s how Java heap usage look like after those modifications:<\/p>\n<div class=\"separator\" style=\"clear: both;text-align: center\"><a href=\"http:\/\/3.bp.blogspot.com\/-IfoQJBKMBnU\/T_ahoq4t2HI\/AAAAAAAAA6o\/KRW-lx6pDP4\/s1600\/Screen-Shot-2012-07-05-at-14.11.png\"><img decoding=\"async\" border=\"0\" height=\"271\" src=\"http:\/\/3.bp.blogspot.com\/-IfoQJBKMBnU\/T_ahoq4t2HI\/AAAAAAAAA6o\/KRW-lx6pDP4\/s400\/Screen-Shot-2012-07-05-at-14.11.png\" width=\"400\" \/><\/a><\/div>\n<p><strong><i>Reference: <\/i><\/strong><a href=\"http:\/\/maciejwalkowiak.pl\/blog\/2012\/07\/05\/solving-rest-spring-security-session-problem\/\">Solving REST + Spring Security session problem<\/a> from our <a href=\"http:\/\/www.javacodegeeks.com\/p\/jcg.html\">JCG partner<\/a> Maciej Walkowiak at the <a href=\"http:\/\/maciejwalkowiak.pl\/\">Software Development Journey<\/a> blog.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>REST, sessions .. wait. There are no sessions in REST application, right? Well, thats true. If we can avoid sessions we should do that. REST is stateless. The main concern about statelessness is authentication. In usual web applications we were used to store user data in session after authentication. How to solve that if we &hellip;<\/p>\n","protected":false},"author":245,"featured_media":242,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[54,30,125],"class_list":["post-1572","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-enterprise-java","tag-restful-web-services","tag-spring","tag-spring-security"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>REST + Spring Security session problem - Java Code Geeks<\/title>\n<meta name=\"description\" content=\"REST, sessions .. wait. There are no sessions in REST application, right? Well, thats true. If we can avoid sessions we should do that. REST is stateless.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"REST + Spring Security session problem - Java Code Geeks\" \/>\n<meta property=\"og:description\" content=\"REST, sessions .. wait. There are no sessions in REST application, right? Well, thats true. If we can avoid sessions we should do that. REST is stateless.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html\" \/>\n<meta property=\"og:site_name\" content=\"Java Code Geeks\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/javacodegeeks\" \/>\n<meta property=\"article:published_time\" content=\"2012-07-06T16:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2012-10-22T06:08:24+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-security-logo.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"150\" \/>\n\t<meta property=\"og:image:height\" content=\"150\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Maciej Walkowiak\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@javacodegeeks\" \/>\n<meta name=\"twitter:site\" content=\"@javacodegeeks\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Maciej Walkowiak\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html\"},\"author\":{\"name\":\"Maciej Walkowiak\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/person\\\/918c1b6d9d8de83830e5b24c0f0f4419\"},\"headline\":\"REST + Spring Security session problem\",\"datePublished\":\"2012-07-06T16:00:00+00:00\",\"dateModified\":\"2012-10-22T06:08:24+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html\"},\"wordCount\":418,\"commentCount\":1,\"publisher\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-security-logo.jpg\",\"keywords\":[\"RESTful Web Services\",\"Spring\",\"Spring Security\"],\"articleSection\":[\"Enterprise Java\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html\",\"name\":\"REST + Spring Security session problem - Java Code Geeks\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-security-logo.jpg\",\"datePublished\":\"2012-07-06T16:00:00+00:00\",\"dateModified\":\"2012-10-22T06:08:24+00:00\",\"description\":\"REST, sessions .. wait. There are no sessions in REST application, right? Well, thats true. If we can avoid sessions we should do that. REST is stateless.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html#primaryimage\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-security-logo.jpg\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2012\\\/10\\\/spring-security-logo.jpg\",\"width\":150,\"height\":150},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/2012\\\/07\\\/rest-spring-security-session-problem.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Java\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/category\\\/java\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Enterprise Java\",\"item\":\"https:\\\/\\\/www.javacodegeeks.com\\\/category\\\/java\\\/enterprise-java\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"REST + Spring Security session problem\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#website\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\",\"name\":\"Java Code Geeks\",\"description\":\"Java Developers Resource Center\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\"},\"alternateName\":\"JCG\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.javacodegeeks.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#organization\",\"name\":\"Exelixis Media P.C.\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/exelixis-logo.png\",\"contentUrl\":\"https:\\\/\\\/www.javacodegeeks.com\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/exelixis-logo.png\",\"width\":864,\"height\":246,\"caption\":\"Exelixis Media P.C.\"},\"image\":{\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/javacodegeeks\",\"https:\\\/\\\/x.com\\\/javacodegeeks\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.javacodegeeks.com\\\/#\\\/schema\\\/person\\\/918c1b6d9d8de83830e5b24c0f0f4419\",\"name\":\"Maciej Walkowiak\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/897c85e1c7fe1b9b9ed640f6ff04c5f2141980d6c5c2b933034783495c8e8db5?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/897c85e1c7fe1b9b9ed640f6ff04c5f2141980d6c5c2b933034783495c8e8db5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/897c85e1c7fe1b9b9ed640f6ff04c5f2141980d6c5c2b933034783495c8e8db5?s=96&d=mm&r=g\",\"caption\":\"Maciej Walkowiak\"},\"sameAs\":[\"http:\\\/\\\/maciejwalkowiak.pl\"],\"url\":\"https:\\\/\\\/www.javacodegeeks.com\\\/author\\\/Maciej-Walkowiak\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"REST + Spring Security session problem - Java Code Geeks","description":"REST, sessions .. wait. There are no sessions in REST application, right? Well, thats true. If we can avoid sessions we should do that. REST is stateless.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html","og_locale":"en_US","og_type":"article","og_title":"REST + Spring Security session problem - Java Code Geeks","og_description":"REST, sessions .. wait. There are no sessions in REST application, right? Well, thats true. If we can avoid sessions we should do that. REST is stateless.","og_url":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html","og_site_name":"Java Code Geeks","article_publisher":"https:\/\/www.facebook.com\/javacodegeeks","article_published_time":"2012-07-06T16:00:00+00:00","article_modified_time":"2012-10-22T06:08:24+00:00","og_image":[{"width":150,"height":150,"url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-security-logo.jpg","type":"image\/jpeg"}],"author":"Maciej Walkowiak","twitter_card":"summary_large_image","twitter_creator":"@javacodegeeks","twitter_site":"@javacodegeeks","twitter_misc":{"Written by":"Maciej Walkowiak","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html#article","isPartOf":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html"},"author":{"name":"Maciej Walkowiak","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/person\/918c1b6d9d8de83830e5b24c0f0f4419"},"headline":"REST + Spring Security session problem","datePublished":"2012-07-06T16:00:00+00:00","dateModified":"2012-10-22T06:08:24+00:00","mainEntityOfPage":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html"},"wordCount":418,"commentCount":1,"publisher":{"@id":"https:\/\/www.javacodegeeks.com\/#organization"},"image":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html#primaryimage"},"thumbnailUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-security-logo.jpg","keywords":["RESTful Web Services","Spring","Spring Security"],"articleSection":["Enterprise Java"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html","url":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html","name":"REST + Spring Security session problem - Java Code Geeks","isPartOf":{"@id":"https:\/\/www.javacodegeeks.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html#primaryimage"},"image":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html#primaryimage"},"thumbnailUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-security-logo.jpg","datePublished":"2012-07-06T16:00:00+00:00","dateModified":"2012-10-22T06:08:24+00:00","description":"REST, sessions .. wait. There are no sessions in REST application, right? Well, thats true. If we can avoid sessions we should do that. REST is stateless.","breadcrumb":{"@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html#primaryimage","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-security-logo.jpg","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2012\/10\/spring-security-logo.jpg","width":150,"height":150},{"@type":"BreadcrumbList","@id":"https:\/\/www.javacodegeeks.com\/2012\/07\/rest-spring-security-session-problem.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.javacodegeeks.com\/"},{"@type":"ListItem","position":2,"name":"Java","item":"https:\/\/www.javacodegeeks.com\/category\/java"},{"@type":"ListItem","position":3,"name":"Enterprise Java","item":"https:\/\/www.javacodegeeks.com\/category\/java\/enterprise-java"},{"@type":"ListItem","position":4,"name":"REST + Spring Security session problem"}]},{"@type":"WebSite","@id":"https:\/\/www.javacodegeeks.com\/#website","url":"https:\/\/www.javacodegeeks.com\/","name":"Java Code Geeks","description":"Java Developers Resource Center","publisher":{"@id":"https:\/\/www.javacodegeeks.com\/#organization"},"alternateName":"JCG","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.javacodegeeks.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.javacodegeeks.com\/#organization","name":"Exelixis Media P.C.","url":"https:\/\/www.javacodegeeks.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/06\/exelixis-logo.png","contentUrl":"https:\/\/www.javacodegeeks.com\/wp-content\/uploads\/2022\/06\/exelixis-logo.png","width":864,"height":246,"caption":"Exelixis Media P.C."},"image":{"@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/javacodegeeks","https:\/\/x.com\/javacodegeeks"]},{"@type":"Person","@id":"https:\/\/www.javacodegeeks.com\/#\/schema\/person\/918c1b6d9d8de83830e5b24c0f0f4419","name":"Maciej Walkowiak","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/897c85e1c7fe1b9b9ed640f6ff04c5f2141980d6c5c2b933034783495c8e8db5?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/897c85e1c7fe1b9b9ed640f6ff04c5f2141980d6c5c2b933034783495c8e8db5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/897c85e1c7fe1b9b9ed640f6ff04c5f2141980d6c5c2b933034783495c8e8db5?s=96&d=mm&r=g","caption":"Maciej Walkowiak"},"sameAs":["http:\/\/maciejwalkowiak.pl"],"url":"https:\/\/www.javacodegeeks.com\/author\/Maciej-Walkowiak"}]}},"_links":{"self":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts\/1572","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/users\/245"}],"replies":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/comments?post=1572"}],"version-history":[{"count":0,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/posts\/1572\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/media\/242"}],"wp:attachment":[{"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/media?parent=1572"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/categories?post=1572"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.javacodegeeks.com\/wp-json\/wp\/v2\/tags?post=1572"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}