title: Spring Security Sessions without cookies
body: <p>I'm trying to manage sessions in Spring Security without leveraging cookies. The reasoning is - our application is displayed within an iframe from another domain, we need to manage sessions in our application, <a href="https://medium.com/@bluepnume/safaris-new-tracking-rules-and-enabling-cross-domain-data-storage-85241eea7483" rel="noreferrer">and Safari restricts cross-domain cookie creation</a>. (context : domainA.com displays domainB.com in an iframe. domainB.com is setting a JSESSIONID cookie to leverage on domainB.com, but since the user's browser is showing domainA.com - Safari restricts domainB.com from creating the cookie). </p>
  
  <p>The only way I can think to achieve this (against OWASP security recommendations) - is to include the JSESSIONID in the URL as a GET parameter. I don't WANT to do this, but I can't think of an alternative. </p>
  
  <p>So this question is both about : </p>
  
  <ul>
  <li>Are there better alternatives to tackling this problem?</li>
  <li>If not - how can I achieve this with Spring Security</li>
  </ul>
  
  <p>Reviewing Spring's Documentation around this, using <a href="https://docs.spring.io/autorepo/docs/spring-security/4.0.1.RELEASE/apidocs/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.html#enableSessionUrlRewriting(boolean)" rel="noreferrer">enableSessionUrlRewriting</a> should allow for this </p>
  
  <p>So I've done this :</p>
  
  <pre><code>@Override
  protected void configure(HttpSecurity http) throws Exception {
      http
          .sessionManagement()
              .sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
              .enableSessionUrlRewriting(true)
  </code></pre>
  
  <p>This didn't add the JSESSIONID to the URL, but it should be allowed now. I then leveraged some code found <a href="https://stackoverflow.com/questions/31791587/spring-boot-remove-jsessionid-from-url">in this question</a> to set the "tracking mode" to URL</p>
  
  <pre><code>@SpringBootApplication
  public class MyApplication extends SpringBootServletInitializer {
  
     @Override
     public void onStartup(ServletContext servletContext) throws ServletException {
        super.onStartup(servletContext);
  
        servletContext
          .setSessionTrackingModes(
              Collections.singleton(SessionTrackingMode.URL)
        );
  </code></pre>
  
  <p>Even after this - the application still adds the JSESSIONID as a cookie and not in the URL. </p>
  
  <p>Can someone help point me in the right direction here?</p>