2022-10-25 07:38:58 +08:00
[[migration]]
= Migrating to 6.0
The Spring Security team has prepared the 5.8 release to simplify upgrading to Spring Security 6.0.
2022-10-26 05:04:43 +08:00
Use 5.8 and its preparation steps to simplify updating to 6.0
2022-10-25 07:38:58 +08:00
2022-10-26 05:04:43 +08:00
After updating to 5.8, follow this guide to perform any needed migration steps.
2022-10-25 07:38:58 +08:00
2022-10-26 05:04:43 +08:00
Also, this guide includes ways to revert to 5.x behaviors and its defaults, should you run into trouble.
2022-10-25 07:38:58 +08:00
2022-10-26 05:04:43 +08:00
== Updating
2022-10-25 07:38:58 +08:00
2022-10-26 05:04:43 +08:00
=== Reactive
2022-10-25 07:38:58 +08:00
2022-10-26 05:04:43 +08:00
==== Remove `useAuthorizationManager` usage from `@EnableReactiveMethodSecurity`
{security-api-url}org/springframework/security/config/annotation/method/configuration/EnableReactiveMethodSecurity.html[`@EnableReactiveMethodSecurity`] sets `useAuthorizationManager` to `true` by default.
Because of that, in 6.0 you can change:
2022-10-25 07:38:58 +08:00
====
.Java
[source,java,role="primary"]
----
2022-10-26 05:04:43 +08:00
@EnableReactiveMethodSecurity(useAuthorizationManager = true)
2022-10-25 07:38:58 +08:00
----
.Kotlin
[source,kotlin,role="secondary"]
----
2022-10-26 05:04:43 +08:00
@EnableReactiveMethodSecurity(useAuthorizationManager = true)
2022-10-25 07:38:58 +08:00
----
====
2022-10-26 05:04:43 +08:00
to:
2022-10-25 07:38:58 +08:00
====
.Java
[source,java,role="primary"]
----
2022-10-26 05:04:43 +08:00
@EnableReactiveMethodSecurity
2022-10-25 07:38:58 +08:00
----
.Kotlin
[source,kotlin,role="secondary"]
----
2022-10-26 05:04:43 +08:00
@EnableReactiveMethodSecurity
2022-10-25 07:38:58 +08:00
----
====
2022-10-26 05:04:43 +08:00
== Reverting
If you are running into trouble with any of the 6.0 changes, please first try to apply the following changes to get you up and running.
It's more important to stay on 6.0 and get the security improvements.
=== Servlet
==== Change `@EnableMethodSecurity` to `@EnableGlobalMethodSecurity`
For applications using `prePostEnabled`, make sure to turn it on to reactivate the behavior.
2022-10-25 07:38:58 +08:00
2022-10-26 05:04:43 +08:00
For example, change:
2022-10-25 07:38:58 +08:00
====
.Java
[source,java,role="primary"]
----
2022-10-26 05:04:43 +08:00
@EnableMethodSecurity
2022-10-25 07:38:58 +08:00
----
.Kotlin
[source,kotlin,role="secondary"]
----
2022-10-26 05:04:43 +08:00
@EnableMethodSecurity
2022-10-25 07:38:58 +08:00
----
====
2022-10-26 05:04:43 +08:00
to:
2022-10-25 07:38:58 +08:00
====
.Java
[source,java,role="primary"]
----
2022-10-26 05:04:43 +08:00
@EnableGlobalMethodSecurity(prePostEnabled = true)
2022-10-25 07:38:58 +08:00
----
.Kotlin
[source,kotlin,role="secondary"]
----
2022-10-26 05:04:43 +08:00
@EnableGlobalMethodSecurity(prePostEnabled = true)
2022-10-25 07:38:58 +08:00
----
====
2022-10-26 05:04:43 +08:00
Other usage can simply change {security-api-url}org/springframework/security/config/annotation/method/configuration/EnableMethodSecurity.html[`@EnableMethodSecurity`] to {security-api-url}org/springframework/security/config/annotation/method/configuration/EnableGlobalMethodSecurity.html[`@EnableGlobalMethodSecurity`], like so:
2022-10-25 07:38:58 +08:00
====
.Java
[source,java,role="primary"]
----
2022-10-26 05:04:43 +08:00
@EnableMethodSecurity(securedEnabled = true, prePostEnabled = false)
2022-10-25 07:38:58 +08:00
----
.Kotlin
[source,kotlin,role="secondary"]
----
2022-10-26 05:04:43 +08:00
@EnableMethodSecurity(securedEnabled = true, prePostEnabled = false)
2022-10-25 07:38:58 +08:00
----
====
2022-10-26 05:04:43 +08:00
should change to:
2022-10-25 07:38:58 +08:00
====
.Java
[source,java,role="primary"]
----
2022-10-26 05:04:43 +08:00
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = false)
2022-10-25 07:38:58 +08:00
----
.Kotlin
[source,kotlin,role="secondary"]
----
2022-10-26 05:04:43 +08:00
@EnableGlobalMethodSecurity(securedEnabled = true, prePostEnabled = false)
2022-10-25 07:38:58 +08:00
----
====
2022-10-26 05:04:43 +08:00
=== Reactive
2022-10-25 07:38:58 +08:00
2022-10-26 05:04:43 +08:00
==== Deactivate `AuthorizationManager` in `@EnableReactiveMethodSecurity`
2022-10-25 07:38:58 +08:00
2022-10-26 05:04:43 +08:00
To opt-out of {security-api-url}org/springframework/security/authorization/AuthorizationManager.html[`AuthorizationManager`] for reactive method security, add `useAuthorizationManager = false`:
2022-10-25 07:38:58 +08:00
====
.Java
[source,java,role="primary"]
----
@EnableReactiveMethodSecurity
----
.Kotlin
[source,kotlin,role="secondary"]
----
@EnableReactiveMethodSecurity
----
====
changes to:
====
.Java
[source,java,role="primary"]
----
2022-10-26 05:04:43 +08:00
@EnableReactiveMethodSecurity(useAuthorizationManager = false)
2022-10-25 07:38:58 +08:00
----
.Kotlin
[source,kotlin,role="secondary"]
----
2022-10-26 05:04:43 +08:00
@EnableReactiveMethodSecurity(useAuthorizationManager = false)
2022-10-25 07:38:58 +08:00
----
====
