The primary reason for classes needing to override attemptAuthentication is that AbstractAuthenticationProcessingFilter ...

OneTimeTokenAuthenticationFilter throws an exception if authenticationConverter returns null. However, it seems reasonab...

Describe the bugThere's a reference to WebFlux that links to the Servlet documentation:xref:servlet/authentication/index...

Describe the bugThere is a broken link on the Spring MVC Test Integration documentation page. The link to "Spring MVC Te...

It would be nice if users could listen for authorization events specific to the type of source:@EventListenerpublic void...

I wonder if it would be better to change PathPatternRequestMatcher to include the servlet in the PathPattern that should...

Describe the bugIn the documentation of One-Time Token Login, the initial code to handle OTT generation under the sub-se...

Resolution of the s101 plugin fails due to 404s on structure101 paths. Possibly related to sonarsource acquisition FAIL...

With the addition of FormPostRedirectStrategy, it would be nice to remove code from the SAML 2.0 filters that do this in...

https://github.com/denberr95/spring-lessonsDescribe the bugI am implementing an application with Spring Boot 3.4.3 and S...

Expected BehaviorImplementing authentication via REST based API should "feel good" when implementing it according to the...

In the Wiki, in the Resource Server section of the OAuth 2.0 Migration Guide there is a duplicate section: ==== Simplifi...

If Spring Security's method security is used on a final class that implements an interface it fails. Instead it should c...

By default @HandleAuthorizationDenied uses an exception-throwing implementation. Another useful implementation would be ...

This would make it type safe for consumers of the API. Instead ofService service = (Service) factory.proxy(new Service()...

Describe the bugthis is how I configure http security using the SS 6.4.3 @Bean open fun securityFilterChain(http: Http...

Related to #14600, if a proxied method in a spel expression throws and AuthorizationDeniedException, this should be prop...

Expected BehaviorUsing a proxy should be much simpler as it's a common use caseCurrent BehaviorRequires applying proxy s...

I made a Spring Boot application using version 3.3.7. I have configured my endpoint to generate some HTTP headers, using...

Expected BehaviorIt should be possible to determine the address that IpAddressMatcher was instantiated with. Via a gette...