At the present moment Spring Boot 2 does not handle automatic web listener registration. For this reason ServletListenerRegistrationBean is recommended to use. But this bean doesn't support relatively new HttpSessionIdListener (actually already legacy from spring boot's point of view) which is necessary to track session when using together with Spring security enabled. At the moment only these types of listeners are supported:
types.add(ServletContextAttributeListener.class);
types.add(ServletRequestListener.class);
types.add(ServletRequestAttributeListener.class);
types.add(HttpSessionAttributeListener.class);
types.add(HttpSessionListener.class);
types.add(ServletContextListener.class);
Also look here at the description of what listeners should be supported.
Comment From: mahairod
Another approach would be make ServletListenerRegistrationBean class inheritable and extensible. Is there any reason why it is not?
Comment From: werthdavid
Does this "kill" Servlet 3.0 support? With Websphere 8.5 I can't get this running now due to these changes if I'm not wrong
Comment From: wilkinsona
We have required Servlet 3.1 since 2.0.x: https://github.com/spring-projects/spring-boot/issues/12370.
Comment From: werthdavid
I see, my bad, I've missed that. In our scenario it has been working with Websphere 8.5 (servlet 3.0) until this change. Thanks for the reply