Spring Security Sessions without cookies : <p>I'm trying to manage sessions in Spring Security without leveraging cookies. The reasoning is - our application is displayed within an iframe from another domain, we need to manage sessions in our application, <a href="https://medium.com/@bluepnume/safaris-new-tracking-rules-and-enabling-cross-domain-data-storage-85241eea7483" rel="noreferrer">and Safari restricts cross-domain cookie creation</a>. (context : domainA.com displays domainB.com in an iframe. domainB.com is setting a JSESSIONID cookie to leverage on domainB.com, but since the user's browser is showing domainA.com - Safari restricts domainB.com from creating the cookie). </p>

<p>The only way I can think to achieve this (against OWASP security recommendations) - is to include the JSESSIONID in the URL as a GET parameter. I don't WANT to do this, but I can't think of an alternative. </p>

<p>So this question is both about : </p>

<ul>
<li>Are there better alternatives to tackling this problem?</li>
<li>If not - how can I achieve this with Spring Security</li>
</ul>

<p>Reviewing Spring's Documentation around this, using <a href="https://docs.spring.io/autorepo/docs/spring-security/4.0.1.RELEASE/apidocs/org/springframework/security/config/annotation/web/configurers/SessionManagementConfigurer.html#enableSessionUrlRewriting(boolean)" rel="noreferrer">enableSessionUrlRewriting</a> should allow for this </p>

<p>So I've done this :</p>

<pre><code>@Override
protected void configure(HttpSecurity http) throws Exception {
    http
        .sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.ALWAYS)
            .enableSessionUrlRewriting(true)
</code></pre>

<p>This didn't add the JSESSIONID to the URL, but it should be allowed now. I then leveraged some code found <a href="https://stackoverflow.com/questions/31791587/spring-boot-remove-jsessionid-from-url">in this question</a> to set the "tracking mode" to URL</p>

<pre><code>@SpringBootApplication
public class MyApplication extends SpringBootServletInitializer {

   @Override
   public void onStartup(ServletContext servletContext) throws ServletException {
      super.onStartup(servletContext);

      servletContext
        .setSessionTrackingModes(
            Collections.singleton(SessionTrackingMode.URL)
      );
</code></pre>

<p>Even after this - the application still adds the JSESSIONID as a cookie and not in the URL. </p>

<p>Can someone help point me in the right direction here?</p>
