Loading published curriculum…

16 · Spring Security in depth / LESSON 79 OF 102

Session login, logout, and cookie policy

A session cookie carries a reference to server-managed authentication state.

Before this lesson: Registration, validation, and privilege assignment

Understand the topic

Form login authenticates credentials and establishes the security context through the configured persistence mechanism. Session fixation protection changes the session identity as appropriate on login. Custom login endpoints must follow the framework’s context-saving and session strategy rather than setting a random attribute.

Use HTTPS and appropriate Secure, HttpOnly, and SameSite cookie settings. Logout should invalidate the session and clear relevant authentication state. A cookie-based application must retain a considered CSRF policy for unsafe operations.

EXAMPLE · PROPERTIES

application.properties for an HTTPS deployment

server.servlet.session.cookie.http-only=true
server.servlet.session.cookie.secure=true
server.servlet.session.cookie.same-site=lax

What to expect

Secure cookies require HTTPS; use a separate explicit local-development configuration when testing plain HTTP. SameSite is defense in depth, not a replacement for CSRF handling.

YOUR TURN

Put it into practice

  1. 01Implement login and logout through Spring Security’s supported flow.
  2. 02Inspect session IDs before and after authentication and test reuse after logout.
  3. 03Verify: Logout invalidates access and the deployed cookie has the intended security attributes.

Pass a quiz or complete a lab to check today’s streak. Each lesson counts once per day, including when you review it later.

UNDER THE HOOD

Build the mental model

A session cookie carries a reference to server-managed authentication state.

  1. 01Form login authenticates credentials and establishes the security context through the configured persistence mechanism. Session fixation protection changes the session identity as appropriate on login. Custom login endpoints must follow the framework’s context-saving and session strategy rather than setting a random attribute.
  2. 02Use HTTPS and appropriate Secure, HttpOnly, and SameSite cookie settings. Logout should invalidate the session and clear relevant authentication state. A cookie-based application must retain a considered CSRF policy for unsafe operations.
  3. 03Trace the example: Secure cookies require HTTPS; use a separate explicit local-development configuration when testing plain HTTP. SameSite is defense in depth, not a replacement for CSRF handling.

A mistake worth avoiding

Login appears successful but the next request is anonymous.

DEBUGGING ROOM

Something broke. Where do you look?

Login appears successful but the next request is anonymous.

Before revealing the diagnosis, write down your first investigation step.

CHECK YOUR UNDERSTANDING

Does HttpOnly stop JavaScript from reading the session cookie?

Choose one answer

BUILD IT YOURSELF

Implement login and logout through Spring Security’s supported flow.

  1. 1.Implement login and logout through Spring Security’s supported flow.
  2. 2.Inspect session IDs before and after authentication and test reuse after logout.
  3. 3.Reproduce this failure, then repair it: Login appears successful but the next request is anonymous.

Acceptance checklist

Lab completion is your self-report. Knowledge checks do not certify project quality.

RETRIEVE IT FROM MEMORY

Does HttpOnly stop JavaScript from reading the session cookie?

Revisit this lesson in three days after a successful check or lab.

Ready for the next step?

Logout invalidates access and the deployed cookie has the intended security attributes.

Reading is separate from passing a knowledge check or completing a lab.

Go deeper · official references