In some cases DefaultAuthorizationCodeTokenResponseClient.getTokenResponse(OAuth2AuthorizationCodeGrantRequest) can retu...

Forward port of #13155 Comment From: marcusdacoregioClosed via https://github.com/spring-projects/spring-security/commit...

Forward-port of #13155 Comment From: marcusdacoregioClosed via https://github.com/spring-projects/spring-security/commit...

Forward-port of #13155 Comment From: marcusdacoregioClosed via https://github.com/spring-projects/spring-security/commit...

The value in https://github.com/spring-projects/spring-security/blob/613165b86c6f12da21675d410b3b22a9ae7a0b7b/web/src/ma...

Hello,I perform the migration from EnableGlobalMethodSecurity to EnableMethodSecurity.So I :1. Change the annotation2. S...

Describe the bugSo I've build frontent application which doing two requests in parallel:- GET /user/info (authenticated ...

I have troubles with this hardcoded POST method, as in my application we do not post logout url and only use get, possib...

I attempted to log in using oauth2 authorization, but the R2dbcReactiveOAuth2AuthorizedClientService.loadAuthorizedClien...

Currently the autoLogin cookie function protected UserDetails processAutoLoginCookie(String[] cookieTokens, ...

Thanks for all the great work, just a minor problem maybe worth mentioning. SetupI have spring-boot app using spring-sec...

Describe the bugHave a SimpleUrlMapping with CorsConfig passing all test for several months now. Am testing with Cors an...

Expected behaviorhttp://www.springframework.org/schema/security/spring-security.xsd returns 404should't it return/point-...

Dependent on https://github.com/spring-projects/spring-security/issues/12232, exposing this authorization manager will a...

The security-method sample in spring-native branch sb-3.0.x. uses @PreAuthorize on a controller. The resulting native im...

This is a follow-up issue:* originally described in https://github.com/spring-projects/spring-security/issues/9900 (whic...

To specify a custom OAuth2AuthorizedClientProvider requires specifying a number of other things as well:@Beanpublic OAut...

Expected BehaviorHttpSecurity's authorizeHttpRequests() uses role hierarchy defined as a bean or defined as a separate m...

Describe the bugIt is possible to use "urn:ietf:params:oauth:grant-type:jwt-bearer" as a valid authorization-grant-type....

Describe the bugDefined role hierarchy is not picked up by AuthorityAuthorizationManager. Role hierarchy: ROLE_SUPERUSER...