From a7f94b21888f1390f960eae78392b362a9902e1c Mon Sep 17 00:00:00 2001 From: Josh Cummings Date: Tue, 18 Sep 2018 10:14:40 -0600 Subject: [PATCH] Separate Servlet and WebFlux Feature Lists Issue: gh-5857 --- .../asciidoc/_includes/preface/whats-new.adoc | 74 ++++++++++--------- 1 file changed, 38 insertions(+), 36 deletions(-) diff --git a/docs/manual/src/docs/asciidoc/_includes/preface/whats-new.adoc b/docs/manual/src/docs/asciidoc/_includes/preface/whats-new.adoc index 0731a8b757..d427393e5c 100644 --- a/docs/manual/src/docs/asciidoc/_includes/preface/whats-new.adoc +++ b/docs/manual/src/docs/asciidoc/_includes/preface/whats-new.adoc @@ -4,42 +4,44 @@ Spring Security 5.1 provides a number of new features. Below are the highlights of the release. -=== New Features +=== Servlet -* <> -** Support for customizing when the `SecurityContext` is setup in the test +* https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2webclient[OAuth 2.0 Client] +** Customizable Authorize and Token requests +** `authorization_code` grant support +** `client_credentials` grant support +* OAuth 2.0 Resource Server - support for https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver[JWT-encoded bearer tokens] +* https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2webclient[OAuth 2.0 Web Client Extensions] - Supports `authorization_code`, `client_credentials`, and `refresh_token` grants +* <> - New service to support password upgrades +* <> - Protection against HTTP Verb Tampering and Cross-site Tracing +* <> - Support for selecting an `AccessDeniedHandler` by `RequestMatcher` +* <> - Support for disabling csrf by `RequestMatcher` +* <> - Support for `Feature-Policy` +* <> - Support for `@Transient` authentication tokens +* A modern look-and-feel for the default log in page + +=== WebFlux + +* https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2webclient-webflux[OAuth 2.0 Client] +** Customizable Authorize requests +** `authorization_code` grant support +** `client_credentials` grant support +* OAuth 2.0 Resource Server - support for https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver-webflux[JWT-encoded bearer tokens] +* https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2webclient-webflux[OAuth 2.0 Web Client Extensions] - Supports `authorization_code`, `client_credentials`, and `refresh_token` grants +* <> - `@WithUserDetails` now works with `ReactiveUserDetailsService` +* <> - Support for CORS was added +* <> - Support for `Content-Security-Policy`, `Feature-Policy`, and `Referrer-Policy` +* Support for redirecting to HTTPS + +=== Integrations + +* <> - Support for `BadCredentialsException` +* <> - Support for customizing when the `SecurityContext` is setup in the test. For example, `@WithMockUser(setupBefore = TestExecutionEvent.TEST_EXECUTION)` will setup a user after JUnit's `@Before` and before the test executes. -** `@WithUserDetails` now works with `ReactiveUserDetailsService` -* <> - added support for `BadCredentialsException` +* <> - Support for setting up an `LdapContext` from custom environment variables +* <> - Support for deriving the X.509 principal via a strategy * <> -** Supports resolving beans in WebFlux (was already supported in Spring MVC) -** Supports resolving `errorOnInvalidType` in WebFlux (was already supported in Spring MVC) -* OAuth 2.0 Client -* OAuth 2.0 Resource Server -** Supports https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver[JWT-encoded bearer tokens] -** Supports configuration using an OIDC Provider Configuration endpoint -** Supports custom JWT decoding -** Supports custom authority mapping -** Supports custom JWT validation -** Supports custom error handling -* OAuth 2.0 Resource Server WebFlux -** Supports JWT-encoded bearer tokens -** Supports configuration using an OIDC Provider Configuration endpoint -** Supports custom JWT decoding -** Supports custom authority mapping -** Supports custom JWT validation -** Supports static key configuration -* <> - Support was added for `@Transient` authentication tokens -* <> - Support was added for disabling csrf by `RequestMatcher` -* <> - Support was added for selecting an `AccessDeniedHandler` by `RequestMatcher` -* <> -** Support for `Content-Security-Policy` and `Referrer-Policy` were added for WebFlux (already supported in Servlets) -** Support for `Feature-Policy` were added -* <> -** Support for CORS was added for WebFlux (already supported in Servlets) -* Redirecting to HTTPS -** Support for HTTPS redirect was added -* WebClient + OAuth2 Support for <> and <> environments -* <> - added support for setting up an `LdapContext` from custom environment variables -* <> - added support for deriving the X.509 principal via a strategy -* The Look and Feel for the default login and logout pages was modernized +** Support for resolving beans in WebFlux (support already exists for Spring MVC) +** Support for resolving `errorOnInvalidType` in WebFlux (support already exists for Spring MVC) + +