2578 Commits

Author	SHA1	Message	Date
Konstantin Filtschew	e4a2ac27d6	Fixed link to CSRF checks	2025-06-27 14:18:01 -05:00
Rob Winch	00ead7f24d	Update to Kotlin 2.2	2025-06-26 17:29:12 -05:00
Tran Ngoc Nhan	e686ac6b11	Remove AbstractSecurityWebSocketMessageBrokerConfigurer ... Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com>	2025-06-24 12:56:05 -06:00
Josh Cummings	a4c338f8a5	Format authorizeExchange Blocks ... This commit formats authorizeExchange blocks to use a common variable name and ensure the variable and reference are on the same line. Issue gh-13067	2025-06-20 10:46:52 -06:00
Josh Cummings	777447e1d9	Format authorizeHttpRequests Blocks ... This commit formats authorizeHttpRequests blocks to use the same parameter name and places the reference on the same line as the parameter. Issue gh-13067	2025-06-20 10:46:51 -06:00
Josh Cummings	c43afbf5e1	Format Lambda Expressions ... This commit updats lambda expressions so that their variable is surrounded in parentheses. Issue gh-13067	2025-06-20 10:41:29 -06:00
Josh Cummings	6ddb964c61	Remove ApacheDS Support ... Closes gh-13852	2025-06-19 11:55:34 -06:00
Rob Winch	b2325e4176	Add OAuth Support for HTTP Interface Client ... Closes gh-16858	2025-06-17 09:53:51 -05:00
Rob Winch	040ffe17e5	Add SubjectX500PrincipalExtractor to Whats New ... Issue gh-16984	2025-06-12 12:19:37 -05:00
Rob Winch	e3add59550	Update x509 Reference ... - Use include-code - Demo how to customize SubjectX500PrincipalExtractor	2025-06-12 12:09:20 -05:00
Rob Winch	7bf2730a53	Add x509@principal-extractor-ref ... Enables customizing the X500PrincipalExtractor	2025-06-12 12:09:20 -05:00
Rob Winch	88ed4a5ccf	Use principalExtractor reference instead of properties	2025-06-12 12:09:20 -05:00
Max Batischev	aba437d469	Add Support SubjectX500PrincipalExtractor ... Closes gh-16980 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-06-12 12:09:20 -05:00
Josh Cummings	9b724377ce	Rework Saml2 Authentication Statement ... This commit separates the authentication principal, the assertion details, and the relying party tenant into separate components. This allows the principal to be completely decoupled from how Spring Security triggers and processes SLO. Specifically, it adds Saml2AssertionAuthentication, a new authentication implementation that allows an Object principal and a Saml2ResponseAssertionAccessor credential. It also moves the relying party registration id from Saml2AuthenticatedPrincipal to Saml2AssertionAuthentication. As such, Saml2AuthenticatedPrincipal is now deprecated in favor of placing its assertion components in Saml2ResponseAssertionAccessor and the relying party registration id in Saml2AssertionAuthentication. Closes gh-10820	2025-06-10 17:21:03 -06:00
Lidoca	d0db5e3ea3	Update database-schema.adoc ... docs: match the database schema with https://github.com/spring-projects/spring-security/blob/6.5.0/docs/modules/ROOT/pages/servlet/authentication/passwords/jdbc.adoc Signed-off-by: Lidoca <32785562+Lidoca@users.noreply.github.com>	2025-06-09 22:17:57 -05:00
Josh Cummings	aa3135169d	Polish Documentation ... Closes gh-14635	2025-06-09 16:49:36 -06:00
Josh Cummings	eaab42a73c	Polish BearerTokenAuthenticationConverter Support ... - Moved to BearerTokenAuthenticationFilter constructor to align with AuthenticationFilter - Undeprecated BearerTokenResolver to reduce number of migration scenarios - Updated to 7.0 schema - Added migration docs Issue gh-14750	2025-06-04 18:17:17 -06:00
Max Batischev	4967f3feee	Add Support BearerTokenAuthenticationConverter ... Closes gh-14750 Signed-off-by: Max Batischev <mblancer@mail.ru>	2025-06-04 18:17:17 -06:00
Josh Cummings	492444c588	Update shouldConvertGetRequests Migration Steps ... Issue gh-17099	2025-06-03 13:12:38 -06:00
Josh Cummings	4ed131f6ab	Add shouldConvertGetRequests Migration Steps ... Issue gh-17099	2025-06-03 13:10:45 -06:00
Josh Cummings	6d3b54df21	Change Type Validation Default ... NimbusJwtDecoder and NimbusReactiveJwtDecoder now use Spring Security's JwtTypeValidator by default instead of Nimbus's type validator. Closes gh-17181	2025-05-28 16:11:13 -06:00
Josh Cummings	37a814bc29	Add 7.0 -> 8.0 Migration Guide ... Closes gh-17182	2025-05-28 16:11:12 -06:00
Felix Hagemans	1a4de49977	Create CsrfCustomizer for SPA configuration ... Closes gh-14149 Signed-off-by: Felix Hagemans <felixhagemans@gmail.com>	2025-05-27 11:44:33 -06:00
Rob Winch	cd27290260	Merge branch '6.5.x' ... Closes gh-17163	2025-05-22 15:01:27 -05:00
Rob Winch	e686621e92	Merge branch '6.5.x' ... Closes gh-17162	2025-05-22 15:01:13 -05:00
Rob Winch	6eee256e12	Demonstrate include-code usage ... Closes gh-17161	2025-05-22 14:59:35 -05:00
Rob Winch	0fecaf4924	Add include-code extension setup for docs ... Closes gh-17160	2025-05-22 14:59:35 -05:00
Josh Cummings	45e81c2d0a	Merge branch '6.5.x'	2025-05-21 14:44:23 -06:00
Josh Cummings	7d49c41e03	Merge branch '6.4.x' into 6.5.x	2025-05-21 14:44:03 -06:00
Josh Cummings	fbfb28456a	Merge branch '6.3.x' into 6.4.x	2025-05-21 14:43:44 -06:00
Gurunathan	a4cd6f4278	Advise Overriding equals() and hashCode() in UserDetails Implementations ... This commit adds a documentation note explaining the importance of overriding equals() and hashCode() in custom UserDetails implementations. The default SessionRegistryImpl in Spring Security uses an in-memory ConcurrentMap<Object, Set<String>>, Map<String,SessionInformation> to associate principals with sessions. If a custom UserDetails class does not properly override equals() and hashCode(), user sessions may not be tracked or matched correctly. I believe this helps developers avoid subtle session management issues when implementing custom authentication logic. Signed-off-by: Gurunathan <129361658+Gurunathan16@users.noreply.github.com>	2025-05-21 12:41:44 -06:00
Josh Cummings	07a50b460a	Merge branch '6.5.x'	2025-05-15 18:17:05 -06:00
Josh Cummings	02a516d7f2	Merge branch '6.4.x' into 6.5.x	2025-05-15 18:16:53 -06:00
Josh Cummings	70c940fd4f	Merge branch '6.3.x' into 6.4.x	2025-05-15 18:16:44 -06:00
Josh Cummings	eb30fd7f59	Add Missing Header ... Issue gh-11161	2025-05-15 18:16:36 -06:00
Josh Cummings	b5db32994f	Merge branch '6.5.x'	2025-05-15 17:20:23 -06:00
Josh Cummings	8548d8e18a	Merge branch '6.4.x' into 6.5.x	2025-05-15 17:20:08 -06:00
Josh Cummings	fbdf4a88a0	Merge branch '6.3.x' into 6.4.x	2025-05-15 17:19:55 -06:00
snowykte0426	260d298cc5	Add Migration Guide from Spring Security SAML Extension ... This adds a dedicated migration guide for users moving from the Spring Security SAML Extension to the built-in SAML 2.0 support. Includes: - Content migrated from the project wiki - xref links for `saml2Login`, `saml2Logout`, and `saml2Metadata` - Metadata example moved to Examples Matrix - Cleanup and naming per review feedback Closes gh-11161 Signed-off-by: snowykte0426 <snowykte0426@naver.com>	2025-05-15 17:17:43 -06:00
Josh Cummings	0698d3527d	Merge branch '6.5.x'	2025-05-13 11:18:43 -06:00
Josh Cummings	26f359a4db	Merge branch '6.4.x' into 6.5.x	2025-05-13 11:18:31 -06:00
Josh Cummings	5ba4ab5e11	Merge branch '6.3.x' into 6.4.x	2025-05-13 11:18:02 -06:00
Danilo Piazzalunga	27319e3f9b	Add missing registration property in YAML listing ... Signed-off-by: Danilo Piazzalunga <danilopiazza@gmail.com>	2025-05-13 11:17:35 -06:00
Danilo Piazzalunga	ec462e8bc5	Update assertingparty property usage in YAML snippets ... Spring Boot 2.7 renamed spring.security.saml2.relyingparty.registration.*.identityprovider.* to spring.security.saml2.relyingparty.registration.*.assertingparty.*. Closes gh-12810. Signed-off-by: Danilo Piazzalunga <danilopiazza@gmail.com>	2025-05-13 11:17:35 -06:00
Joe Grandja	ba7be9c8b9	Merge branch '6.5.x'	2025-05-09 16:14:34 -04:00
Joe Grandja	e3c39f02bc	Add documentation for DPoP support ... Closes gh-17072	2025-05-09 16:02:14 -04:00
Rob Winch	f13836c9c8	Add X to CommonOAuth2Provider Reference ... Issue gh-16510 Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com>	2025-05-07 11:31:28 -05:00
Josh Cummings	211b1b7285	Update Method Security Migration Steps	2025-05-06 16:44:20 -06:00
Josh Cummings	84db5bb312	Add Cookie Customizer Migration Steps	2025-05-06 16:43:04 -06:00
Josh Cummings	74a25c3fc1	Add shouldFilterAllDispatcherTypes Migration Steps	2025-05-06 16:40:10 -06:00