As per the documentation, https://docs.spring.io/spring-security/site/docs/3.0.x/reference/technical-overview.html. I am planning to use Spring Security in my web application that calls some REST webservice, is it necessary to set the SessionCreationPloicy to STATELESS as this example, https://github.com/spring-projects/spring-boot/issues/2755. Spring Security stores the SecurityContext(Session) between requests, but we know that REST is stateless and doesn't use HTTP sessions.
What are the issues of using Spring Security with an application that calls REST webservice without setting it to Stateless ?