Does Spring Session require the use of Spring Security? - spring

Question

Does spring session internally require the use of spring security?
Right now, we have an existing application which uses HTTP session from servlet container (e.g. WebLogic). Due to some issues on session replication and for future plans to use another servlet container, we decided to look for existing framework that would make the HTTP session container independent.
The team decided to look at Spring Session in combination with Hazelcast as described in official documentation. We use spring session version 1.3.5.RELEASE.
For hazelcast configuration, we use this session configuration.
<context:annotation-config/>
<bean class="org.springframework.session.hazelcast.config.annotation.web.http.HazelcastHttpSessionConfiguration"/>
<bean id="hazelcastInstance" class="org.springframework.beans.factory.config.MethodInvokingFactoryBean">
<property name="staticMethod" value="xxx.xxx.xxx.cache.CustomHazelcastProvider.getInstance"/>
</bean>
<bean class="org.springframework.session.web.http.SessionEventHttpSessionListenerAdapter">
<constructor-arg>
<list>
<bean class="xxx.xxx.xxx.util.CustomHttpSessionListener"/>
</list>
</constructor-arg>
</bean>
<bean class="org.springframework.session.web.http.DefaultCookieSerializer">
<property name="cookieName" value="JSESSIONID"/>
<property name="cookiePath" value="/"/>
<property name="domainNamePattern" value="^.+?\.(\w+\.[a-z]+)$"/>
</bean>
In web.xml, we put this filter chain.
<filter>
<filter-name>springSessionRepositoryFilter</filter-name>
<filter-class>org.springframework.web.filter.DelegatingFilterProxy</filter-class>
</filter>
<filter-mapping>
<filter-name>springSessionRepositoryFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
<filter>
<filter-name>CustomServletRequestFilter</filter-name>
<filter-class>xxx.xxx.xxx.servlet.filter.CustomServletRequestFilter</filter-class>
</filter>
<filter-mapping>
<filter-name>CustomServletRequestFilter</filter-name>
<url-pattern>/*</url-pattern>
</filter-mapping>
And added spring configuration below in web.xml
<listener>
<listener-class>org.springframework.web.context.ContextLoaderListener</listener-class>
</listener>
<context-param>
<param-name>contextConfigLocation</param-name>
<param-value>classpath*:application-context.xml</param-value>
</context-param>
In the same web.xml, we use form-based authentication.
<login-config>
<auth-method>FORM</auth-method>
<realm-name>myrealm</realm-name>
<form-login-config>
<form-login-page>/login.html</form-login-page>
<form-error-page>/loginerror.html</form-error-page>
</form-login-config>
</login-config>
In addition, we are using the default cookie based HTTP strategy.
After deploying the said changes in weblogic, we are able to get a successful login. Able to check the session ID coming from spring session. However, the next hop or succeeding REST calls, it always returns HTTP 302. It gets redirected to login page.
Does spring session require the use of spring security? Is there some configuration that we need to add to resolve this issue?
Will appreciate any help or suggestion to resolve this issue.
Thank you.