Similar to RequestHeaderRequestMatcher, it would be nice to match on parameters. This is already in use privately in Saml2LogoutConfigurer. It is also alluded to in https://github.com/spring-projects/spring-security/issues/15017.