Although it's not documented, WebFilter can be configured programmatically especially in Spring Boot applications (see the related guide). This provides an easier configuration but needs to be validated such that no functionality is missed when configured that way -- registration of SessionListener and SpringAwareWebFilter in particular.