Migrated from SEC-2641Comment From: rwinchThe samples have been externalized to https://github.com/spring-projects/sprin...

Migrated from SEC-2642Comment From: rwinchThe samples have been externalized to https://github.com/spring-projects/sprin...

Migrated from SEC-2643Comment From: rwinchThe samples have been externalized to https://github.com/spring-projects/sprin...

Migrated from SEC-2644Comment From: rwinchThe samples have been externalized to https://github.com/spring-projects/sprin...

Migrated from SEC-2645Comment From: rwinchThe samples have been externalized to https://github.com/spring-projects/sprin...

Migrated from SEC-2694Comment From: rwinchClosing as Reactor support has been implemented

Jon Nermut (Migrated from SEC-2721) said:If one tries to call setWriteListener on a ServletOutputStream on a stream that...

cemo koc (Migrated from SEC-2795) said:I could not understand why SecurityContextHolderAwareRequestFilter is a GenericBe...

Juraj Misur (Migrated from SEC-3201) said:Using spring-security-oauth2 2.0.8.RELEASE.JdbcTokenStore logs access token wh...

It would be nice if we could delay looking up the SecurityContext for requests that might be marked as permitAll. This w...

org.springframework.security.web.firewall.RequestWrapper not declared publicTrying to create an filter to handle certain...

SummaryIn a lot of security audits one thing that usually comes up is not to use untrusted data without validation/sanit...

The Spring Security Firewall is preventing the addition of folded http headers. Attempting to do so results in an Illeg...

We are using Spring cloud starter in project which has spring-security-rsa-1.0.3.RELEASE.jar dependency. Veracode has re...

SummaryExceptionTranslationFilter.handleSpringSecurityException is swallowing AccessDeniedException when authentication ...

SummaryDuring the matches operation, SCryptPasswordEncoder retains the instance keyLength rather than the target digest ...

Expected BehaviorMethodSecurityExpressionRoot is a convenient base class to extend security SpEL. Unfortunately, it has ...

Describe the bughttps://stackoverflow.com/questions/25380661/spring-security-and-super-classPreAuthorize annotation curr...

Describe the bugDo not execute the initFilterBean method when a filter is defined within the SecurityFilterChain bean de...

I propose to increase the default strength for some password encoders.The BCrypt encoder currently uses 10 as default st...