Security-session only looks for old config

[jameskleeh]

@Configuration
@Requires(property = SecuritySessionConfigurationProperties.PREFIX + ".enabled", notEquals = StringUtils.FALSE)
package io.micronaut.security.session;

If someone moves to the new config and sets authentication = cookie, with security-session on the classpath, session related beans will still override

[sdelamo]

Not sure if I am understand.

If you have both security-jwt and security-session.

If you have micronaut.micronaut.authentication: cookie'.

SecuritySessionLoginHandler will not be loaded because the class will be annotated with @Requires(property = SecurityConfigurationProperties.PREFIX + ".authentication", value = "session")

Please, not that for authentication: cookie to work you need security-jwt module.

The @Configuration you mention will disable every session bean if you want that.