Disabling built-in session management in Spring Boot config, see more in https://blog.gypsyengineer.com/en/security/tips-configuring-security-rest-api-spring.html

SecurityConfig.java

@Configuration
@EnableWebSecurity
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.sessionManagement()
            .sessionCreationPolicy(SessionCreationPolicy.STATELESS);
        // ...
    }
}