Spring Security Login using Incognito Browser, then start another Incognito session. Already logged in

Describe the bug

After authenticating locally on a Spring boot app with an incognito browser. When I open a new Incognito browser, I should be challenged/forced to authenticate again.

To Reproduce

Spring Boot + Security: 5.5.2.

1. Start Spring boot service locally (localhost)
2. Start Firefox or Chrome private/incognito browser instance
3. Login to Spring Boot App (Spring Boot Security + Oauth2)
4. Login successful
5. Open another private/incognito browser instance
6. Navigate to secure webpage
7. No prompt to login, automatically access the webpage

or

Rename or delete JSESSIONID cookie in Incognito browser, refresh page. A new one is generated.

Expected behavior

Every incognito/private browser session should be forced to authenticate.

Comment From: eleftherias

Hi @tomaytotomato, this is the intended behaviour in Chrome. You will notice that this is not specific to Spring Security applications. If you log into any website, for example, Gmail, Facebook etc you will notice the same behavior.