Currently the SessionManagementConfigurer allows for setting an invalidSessionUrl to be redirected to when the session is detected as invalid. However we would not like to send a redirect but instead send a custom status code.

Currently I would have to create an ObjectPostProcessor which overrides or sets the configured InvalidSessionStrategy.