You could also try to add this .securityContext((sc) -> sc.requireExplicitSave(false)) wehn building your SecurityFilterChain bean.

For more details, see https://docs.spring.io/spring-security/reference/6.0/migration/servlet/session-management.html