With stateless enabled, Spring Security still uses sessions for CSRF

[platosha]

As a developer, I want to use stateless authentication in my app based on Fusion and Spring Security, so that it does not rely on server-side sessions.

Steps in a V22 Fusion / Spring Security application:

• Following the docs, use setStatelessAuthentication to enable stateless authentication
• Start the dev server, open in the browser and log in
• Restart the server without reloading the browser page
• After the restart, make an endpoint call from the browser

Expected:

The endpoint call resolves.

Actual:

The endpoint call rejects, there is an Invalid CSRF token error in CsrfFilter on the server side visible in spring security debug logs.

[platosha]

Let us make sure using tests that the session does not exist on the server when endpoints are called.