How to use Spring HeaderHttpSessionIdResolver with

Question

I'm attempting to write a Spring boot application that uses Oauth2 and Google OpenID for login but instead of tracking the session using cookies, I'd like to track it with auth headers (X-auth or Authentication-info.

I'm persisting sessions using JDBC at the moment and login works perfectly when using cookies, but as soon as I tell spring to use auth-headers the Oauth process begins failing.

This is apparently failing because The appropriate session information isn't getting passed to/back from Google. My login process produces 3 "sessions"

1. When the user first tries to access the page and gets the login page
2. When the token response is returned from google. This session indicates an error of "authorization_request_not_found"
3. When the user is re-directed back to the login page.

It looks like some info about the session is being passed to/back from google but the session ID's doing look right

Request to google auth is:

 https://accounts.google.com/o/oauth2/v2/auth?response_type=code&client_id=1111111111111-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx.apps.googleusercontent.com&scope=openid%20profile%20email&state=NGW6kTxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%3D&redirect_uri=http://localhost.com:9733/login/oauth2/code/google

Callback from google auth:

 http://localhost:9733/login/oauth2/code/google?state=NGW6kTxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx%3D&code=4/xxxx_xxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx&scope=openid+email+profile+https://www.googleapis.com/auth/userinfo.profile+https://www.googleapis.com/auth/plus.me+https://www.googleapis.com/auth/userinfo.email&authuser=0&session_state=6ee92xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx..2618&prompt=none

Here's some info about by spring config.

SecurityConfig.java

@Configuration
public class SecurityConfig extends WebSecurityConfigurerAdapter {

    @Override
    protected void configure(HttpSecurity http) throws Exception {
        http.authorizeRequests()
                .anyRequest().authenticated()
            .and()
            .oauth2Login().and().logout().logoutSuccessUrl("/");
    }


}

HttpSessionConfig.java

@Configuration
@EnableJdbcHttpSession
public class HttpSessionConfig extends 
AbstractHttpSessionApplicationInitializer {
    @Bean
    public HttpSessionStrategy httpSessionStrategy() {
        return new HeaderHttpSessionStrategy();
    }

    @Bean
    public HttpSessionIdResolver httpSessionIdResolver() {
        return HeaderHttpSessionIdResolver.authenticationInfo();
    }

}

application.propeerties

spring.security.oauth2.client.registration.google.client-id=xxxx.apps.googleusercontent.com
spring.security.oauth2.client.registration.google.client- 
secret=xxxxxxxxx-xxxxx


server.servlet.session.persistent=true
spring.session.store-type=jdbc
spring.session.jdbc.initialize-schema=always