quote
create-session Controls the eagerness with which an HTTP session is created by Spring Security classes. Options include:
always - Spring Security will proactively create a session if one does not exist. If a session does not currently exist, Spring Security will automatically create an
ifRequired - Spring Security will only create a session only if one is required (default value). SpringSecurity will only create a session when it is required.
never - Spring Security will never create a session, but will make use of one if the application does. Spring Security will not automatically create a session, but will try to use an existing session, which may be created by the webapp itself.
stateless - Spring Security will not create a session and ignore the session for obtaining a Spring Authentication. Spring Security will never create nor use a session
always - Spring Security will proactively create a session if one does not exist. If a session does not currently exist, Spring Security will automatically create an
ifRequired - Spring Security will only create a session only if one is required (default value). SpringSecurity will only create a session when it is required.
never - Spring Security will never create a session, but will make use of one if the application does. Spring Security will not automatically create a session, but will try to use an existing session, which may be created by the webapp itself.
stateless - Spring Security will not create a session and ignore the session for obtaining a Spring Authentication. Spring Security will never create nor use a session