Spring Security with Spring Session: how to forbid updating of session last access time for particular requests

Question

The thing I want to do is to exclude requests on /my-path from any checks by Spring Security. The problem is that I have a path /my-path. And requests for this path should not update the last access time in Spring Session. The way the request passes is through SecurityContextPersistenceFilter, where the filter loads the context via SecurityContextRepository. And the SecurityContextRepository gets the session, which updates last accessed time. So the question is: Is it possible to exclude requests on /my-path from any sessions checks?

Answer 1

<http pattern="/my-path" security="none"/>

or Java config

web.ignoring().antMatchers("/my-path");