import org.springframework.session.web.http.HeaderHttpSessionStrategy; //导入依赖的package包/类
@Override
protected void configure(HttpSecurity http) throws Exception {
	final RequestMatcher textHtmlMatcher = new MediaTypeRequestMatcher(
			contentNegotiationStrategy,
			MediaType.TEXT_HTML);

	final String loginPage = dashboard("/#/login");

	final BasicAuthenticationEntryPoint basicAuthenticationEntryPoint = new BasicAuthenticationEntryPoint();
	basicAuthenticationEntryPoint.setRealmName(securityProperties.getBasic().getRealm());
	basicAuthenticationEntryPoint.afterPropertiesSet();

	http
		.csrf()
		.disable()
		.authorizeRequests()
		.antMatchers("/")
		.authenticated()
		.antMatchers(
				dashboard("/**"),
				"/authenticate",
				"/security/info",
				"/features",
				"/assets/**").permitAll()
	.and()
		.formLogin().loginPage(loginPage)
		.loginProcessingUrl(dashboard("/login"))
		.defaultSuccessUrl(dashboard("/")).permitAll()
	.and()
		.logout().logoutUrl(dashboard("/logout"))
			.logoutSuccessUrl(dashboard("/logout-success.html"))
		.logoutSuccessHandler(new HttpStatusReturningLogoutSuccessHandler()).permitAll()
	.and().httpBasic()
		.and().exceptionHandling()
		.defaultAuthenticationEntryPointFor(
				new LoginUrlAuthenticationEntryPoint(loginPage),
				textHtmlMatcher)
		.defaultAuthenticationEntryPointFor(basicAuthenticationEntryPoint,
				AnyRequestMatcher.INSTANCE)
	.and()
		.authorizeRequests()
		.anyRequest().authenticated();

	final SessionRepositoryFilter<ExpiringSession> sessionRepositoryFilter = new SessionRepositoryFilter<ExpiringSession>(
			sessionRepository());
	sessionRepositoryFilter
			.setHttpSessionStrategy(new HeaderHttpSessionStrategy());

	http.addFilterBefore(sessionRepositoryFilter,
			ChannelProcessingFilter.class).csrf().disable();
	http.sessionManagement().sessionCreationPolicy(SessionCreationPolicy.IF_REQUIRED);
}
 

import org.springframework.session.web.http.HeaderHttpSessionStrategy; //导入依赖的package包/类
@Bean
public HttpSessionStrategy httpSessionStrategy() {
    return new HeaderHttpSessionStrategy();
}
 

import org.springframework.session.web.http.HeaderHttpSessionStrategy; //导入依赖的package包/类
@Bean
public HttpSessionStrategy httpSessionStrategy() {
    HeaderHttpSessionStrategy headerHttpSessionStrategy = new HeaderHttpSessionStrategy();
    headerHttpSessionStrategy.setHeaderName("Authorization");
    return headerHttpSessionStrategy;
}
 

import org.springframework.session.web.http.HeaderHttpSessionStrategy; //导入依赖的package包/类
@Bean
HeaderHttpSessionStrategy sessionStrategy() {
  return new HeaderHttpSessionStrategy();
}
 

import org.springframework.session.web.http.HeaderHttpSessionStrategy; //导入依赖的package包/类
@Bean
public HttpSessionStrategy httpSessionStrategy() {
	return new HeaderHttpSessionStrategy();
}
 

import org.springframework.session.web.http.HeaderHttpSessionStrategy; //导入依赖的package包/类
@Bean
public HttpSessionStrategy httpSessionStrategy() {
        return new HeaderHttpSessionStrategy(); 
}
 

import org.springframework.session.web.http.HeaderHttpSessionStrategy; //导入依赖的package包/类
/**
 * 推荐使用：
 * 用来定义Spring Session的 HttpSession 集成使用HTTP的头来取代使用 cookie 传送当前session信息
 * @return
 */
@Bean  
   public HttpSessionStrategy headerHttpSessionStrategy() {  
       return new HeaderHttpSessionStrategy();  
   }