title: reactjs with proxy not getting anonymous session from spring boot backend
body: <p>I'm trying to use create-react-app to start the frontend for my spring-boot project.</p>
  
  <p>I use redis to store sessions.</p>
  
  <p>For some reason I actually need to enable session generation for anonymous users. </p>
  
  <p>The following code is my security config for spring boot:</p>
  
  <pre><code>@Configuration
  @EnableWebSecurity
  public class SecurityConfig extends WebSecurityConfigurerAdapter {
  
      @Override
      protected void configure(HttpSecurity http) throws Exception {
          //@formatter:off
          http
              .formLogin()
                  .loginPage("/login")
                      .permitAll()
                  .loginProcessingUrl("/form-login")
                  .and()
              .cors()
                  .and()
              .csrf()
                  .disable()
              .authorizeRequests()
                  .antMatchers("/restricted/**")
                      .authenticated()
                  .antMatchers("/**")
                      .permitAll()
                  .and()
             .sessionManagement()
                  .sessionCreationPolicy(SessionCreationPolicy.ALWAYS);
          //@formatter:on
      }
  }
  </code></pre>
  
  <p>I've tested this by having a very simple index.html inside the "static" folder under my spring-boot project. Then I go to "<a href="http://localhost:8080" rel="nofollow noreferrer">http://localhost:8080</a>" and I saw the session cookie.</p>
  
  <p>Then I removed "index.html" file and start the react app with proxy config. By default the new url is "<a href="http://localhost:3000" rel="nofollow noreferrer">http://localhost:3000</a>". I do see the default reactjs startup page but I no longer get any session cookies.</p>
  
  <p>My proxy setting in "package.json" for my create-react-app is as follows:</p>
  
  <pre><code>"proxy": "http://localhost:8080"
  </code></pre>
  
  <p>I also tested that I can still get session cookie only if I directly go to "<a href="http://localhost:8080" rel="nofollow noreferrer">http://localhost:8080</a>" instead of port 3000.</p>
  
  <p>Any help is appreciated. Thanks so much in advance.</p>