玖涯软件开发|java/go/python

Spring Security Support method security annotations for both synchronous and reactive methods in the same app.

SummaryI'd like the ability to use method security annotations (e.g. @PreAuthorize) on both synchronous and reactive met...

Spring Security OAuth2 Resource Server is exposing server information.

Given I created a custom JWT decoder as described in the Spring OAuth2 Resource Server Documentation with NimbusJwtDecod...

Spring Security How to Add a Signature to Service Provider Metadata

I'm currently in the process of migrating my application's authentication from Spring Security SAML Extension to Spring ...

Spring Security Unable to access HttpServletRequest inside authorizationRequestCustomizer

Expected BehaviorMember authorizationRequestCustomizer of DefaultOAuth2AuthorizationRequestResolver is of type Consumer&...

Spring Security SEC-2409: Spring Security / Spring Data Acl Integration

Rob Winch (Migrated from SEC-2409) said:Spring Security's ACL implementation allows users to determine if a access is al...

Spring Security Add native support for SAML 2.0

We should look into how to make the SAML 2.0 support native compatible. At first, it seems not viable for the Spring Sec...

Spring Security Upgrade nimbus-jose-jwt:jar to 9.37.3

org.springframework.security:spring-security-oauth2-jose:jar:6.2.3 has a dependency to com.nimbusds:nimbus-jose-jwt:jar:...

Spring Security Wrong information for RequestCacheAwareFilter in the Spring Security documentation.

The documentation for Spring Security, section Servlet Architecture -> Architecture mentions the following: "The Req...

Spring Security Simplify Disabling application/x-www-form-urlencoded Encoding Client ID and Secret

There are quite a few authorization servers (see how many users have commented on gh-10018) that do not URL Encode the C...

Spring Security OAuth2 Client Authentication docs are incomplete

We should add some information for the following client authentication methods:client_secret_basicclient_secret_postnone...

Spring Security Support Certificate-Bound (POP) Opaque Access Token Validation

This issue is related to gh-10538 and will address validating certificate-bound "opaque" access tokens for both the Serv...

Spring Security Websocket XHR fallbacks get IllegalStateException: Cannot create a session after the response has been committed upgrading to Boot 3.2.7

Describe the bugI recently upgraded from Boot 2.7 to 3.2.7.Since then I am getting a lot of java.lang.IllegalStateExcept...

Spring Security Inconsistent state between SecurityContextHolder and ReactiveSecurityContextHolder

Describe the bugI am using Spring MVC to create a service and Spring WebFlux to use WebClient. WebClient uses JWT to aut...

Spring Security requestMatchers does not execute .permitAll() for not registered Bean

Describe the bugversion- spring boot 3.0.1- spring security 6.0.1not execute .permitAll()just not registered controller....

Spring Security InMemoryUserDetailsManager: consider improving the error message when no PasswordEncoding has been specified

Expected BehaviorFor my testing environment, I have specified a user in memory as shown below. Per the documentation, it...