Vue/SpringBoot: Why does my JSESSIONID keep changing

Question

I have a vue application with Spring Boot 3.0.1 backend and I want to use CSRF. The Vue frontend and Spring Boot backend are served by different systems. I'm planning to use an nginx reverse proxy to mitigate the CORS topic, but this problem occurs whether nginx is involved or not.

The first thing my vue application does is request the csrf token, storing it globally so that it can be used during the user session.

When a user logs in, several pinia stores are initialized. But unfortunately, during these requests, the JSESSIONID cookie sent with each request is ignored by the backend and a new JSESSIONID is emitted. The JSESSIONID keeps changing while using the application and making further GET requests

This makes the "global" stored CSRF token of the initial JSESSIONID invalid of course...

"csrf" request header:

"Login" title:

Then suddenly the 5th request got a new JSESSIONID even though I sent the JSESSIONID cookie in the request (sent by the server - why?

Question

Why do my sessions keep changing? Shouldn't my JSESSIONID always remain the same?

What is the purpose of conducting CSRF? Request new token before making any (non-GET?) request? (Mine gets using "credentials: "same origin"")

Answer 1

I have .sessionManagement().sessionCreationPolicy(SessionCreationPolicy.STATELESS) in my SecurityConfig, which is causing trouble... As far as I know, removing it solves the CSRF usage. p>