Describe the bugThe BasicAuthenticationFilter skips re-authentication if the username changes in the basic authenticatio...

To align with the behavior of WebSecurityConfigurerAdapter, the HttpSecurityConfiguration class should inject the Conten...

Describe the bugWhen using Spring Boot 3.0.0-M5 to build a native application with the ./mvnw -Pnative package and the a...

Describe the bugREADME.adoc says that "./gradlew build" will build docs, but it builds only api docs. I could not find ...

Describe the bugThis is a bug related to SAML2 InResponseTo validation, and I have tested Firefox, Safari, this bug or s...

ContextRight now I'm spending a lot of time futzing around trying to figure out how to use spring-cloud-openfeign with t...

Current BehaviorCurrently, when attempting to work withz invalid client ID, an ERROR is logged : Authorization Request f...

Describe the bug:I implement a webapp using Spring Boot and Spring Security. Passwords of my users are stored in my DB a...

Expected Behaviorspring.security.oauth2.client.registration.{provider}.authorization-grant-type: CLIENT_CREDENTIALSshoul...

Rather than totally ignoring saving the SecurityContext we should place it on the request as a request attribute to ensu...

When components access the SecurityContext statically through SecurityContextHolder, this can create race conditions whe...

We should rename CsrfTokenRequestAttributeHandler to CsrfTokenRequestHandler and refactor CsrfFilter to no longer need C...

Expected BehaviorDefaultOAuth2UserService can be extended to e.g. allow for custom body parsing to handle application/jw...

The @Autowired from that method was removed in https://github.com/spring-projects/spring-security/issues/9256.Since the ...

uxbux hulan (Migrated from SEC-2767) said:using: spring & spring-mvc 4.1.0.RELEASE when annotated controllers with @...

Expected BehaviorWould great to have something similar to defaultSuccessUrl as in case of OAuth2 login for OAuth2 client...

SummaryI have to consume a 3rd party REST API. This API does not support client_credentials authentication grant type. I...

Kyrill Alyoshin (Migrated from SEC-1667) said:We do have scenarios when we have to call SecurityContextHolder#getContext...

Expected BehaviorWould great if with authorizationFailureHandler it would be possible to provide a custom error response...

Describe the bugIn version spring boot 2.6.8, eventPublisher was set up in ProviderManager as follows@Configurationpubli...