We should add support for one time token authentication, one common example is magic links sent in email or a text code ...

Describe the bugWith the update to spring-boot-3.3.5, our spring-cloud-gateway application breaks within the built-in "R...

Describe the bugWhen using opaque tokens with an OAuth 2 resource server, webflux's ServerBearerTokenAuthenticationConve...

Given some of the responses in #4370, it would likely be helpful to add to the Jackson documentation, detailing the rati...

Describe the bugWhen i custom reactiveUserDetail or custom reactiveAuthenProvider , maximumSessions() not working **code...

Spring Boot 3.3.5 includes spring-security-web-6.3.4.jar. The newly introduced class org.springframework.security.web.se...

Describe the bugThe example here doesn't work.To ReproduceJust repeat the customization and see that the requests are no...

Hello Team,I'm currently spring security 6.2 which internally uses OpenSAML 4.3 Java library to handle the SAML assertio...

Describe the bugI've migrated from spring boot 2.7.18 to spring boot 3.3.4, I've a SAML 2.0 with OpenSaml in my project,...

To active OIDC Back-Channel Logout support in the DSL, an application does this:http .oidcLogout((oidc) -> oidc.ba...

Describe the bugReferring to: #8882When defining a custom NimbusJwtDecoder i am receiving a java.lang.StackOverflowError...

Expected BehaviorOn successful saml2logout, there must be successUrl or handler that will redirect to page of our choice...

Expected BehaviorWe are using an IDP that sends back-channel logout request with a token type set as logout+jwt which sh...

As described in https://github.com/spring-cloud/spring-cloud-gateway/issues/3570#issuecomment-2437407696 starting with S...

Expected BehaviorClientRegistrations RestTemplate is configurable.Current BehaviorClientRegistrations RestTemplate is no...

Describe the bugI'm not sure if this is the intended behavior where SecurityContextHolder is not populated or accessible...

I have a legacy OAuth2 API I need to use, and it requires the use of a password grant. Support for password grants was r...

Describe the bugOnce I added a DispatcherServlet to my EAR application deployed on JBoss 7.4, I started to get the follo...

To reduce code duplication between InMemoryOneTimeTokenService and JdbcOneTimeTokenService, need to separate out the sha...

To support reactive one-time token login for a clustered environment, need to implement R2dbcReactiveOneTimeTokenService...