What does SessionCreationPolicy.STATELESS actually do, and when should you use it?

It instructs Spring Security to never create or rely on an HttpSession for authentication — every request must independently prove its identity (typically via a JWT in the Authorization header). It's the standard choice for REST APIs consumed by SPAs/mobile clients and for horizontally-scaled microservices, since it removes any need for sticky sessions or a shared session store.