Merge branch '7.1.x'

config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java

@@ -379,9 +379,8 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 			}
 			if (filter instanceof AuthorizationFilter authorization) {
 				AuthorizationManager<HttpServletRequest> authorizationManager = authorization.getAuthorizationManager();
-				builder.add(securityFilterChain::matches,
-						(authentication, context) -> (AuthorizationDecision) authorizationManager
-							.authorize(authentication, context.getRequest()));
+				builder.add(securityFilterChain::matches, (authentication, context) -> authorizationManager
+					.authorize(authentication, context.getRequest()));
 				mappings = true;
 			}
 		}

docs/modules/ROOT/pages/servlet/appendix/faq.adoc

@@ -695,7 +695,7 @@ class MyAuthoritiesPopulator : LdapAuthoritiesPopulator {
 
 You would then add a bean of this type to your application context and inject it into the `LdapAuthenticationProvider`. This is covered in the section on configuring LDAP by using explicit Spring beans in the LDAP chapter of the reference manual.
 Note that you cannot use the namespace for configuration in this case.
-You should also consult the {security-api-url}[Javadoc] for the relevant classes and interfaces.
+You should also consult the xref:attachment$api/java/index.html[Javadoc] for the relevant classes and interfaces.
 
 
 [[appendix-faq-namespace-post-processor]]

docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc

@@ -43,7 +43,7 @@ In the following sections we will explore how to configure OTT Login for your ne
 [[default-pages]]
 == Default Login Page and Default One-Time Token Submit Page
 
-When the `oneTimeTokenLogin()` DSL is used, by default the One-Time Token Login Page is auto-generated by the org.springframework.security.web.authentication.ui:DefaultLoginPageGeneratingFilter[].
+When the `oneTimeTokenLogin()` DSL is used, by default the One-Time Token Login Page is auto-generated by the javadoc:org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter[].
 The DSL will also set up the javadoc:org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter[] to generate a default One-Time Token submit page.
 
 [[sending-token-to-user]]
@@ -90,7 +90,7 @@ public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTok
 
     @Override
     public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException {
-        UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
+        UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(request.getRequestURL().toString())
                 .replacePath(request.getContextPath())
                 .replaceQuery(null)
                 .fragment(null)
@@ -148,7 +148,7 @@ class MagicLinkOneTimeTokenGenerationSuccessHandler(
 ) : OneTimeTokenGenerationSuccessHandler {
 
     override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        val builder = UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request))
+        val builder = UriComponentsBuilder.fromUriString(request.getRequestURL().toString())
             .replacePath(request.contextPath)
             .replaceQuery(null)
             .fragment(null)
@@ -212,7 +212,7 @@ public class SecurityConfig {
             // ...
             .formLogin(Customizer.withDefaults())
             .oneTimeTokenLogin((ott) -> ott
-                .generateTokenUrl("/ott/my-generate-url")
+                .tokenGeneratingUrl("/ott/my-generate-url")
             );
         return http.build();
     }
@@ -239,7 +239,7 @@ class SecurityConfig {
                 //...
                 formLogin { }
                 oneTimeTokenLogin {
-                    generateTokenUrl = "/ott/my-generate-url"
+                    tokenGeneratingUrl = "/ott/my-generate-url"
                 }
             }
             return http.build()
@@ -283,7 +283,7 @@ public class SecurityConfig {
             // ...
             .formLogin(Customizer.withDefaults())
             .oneTimeTokenLogin((ott) -> ott
-                .submitPageUrl("/ott/submit")
+                .defaultSubmitPageUrl("/ott/submit")
             );
         return http.build();
     }
@@ -310,7 +310,7 @@ class SecurityConfig {
                 //...
                 formLogin { }
                 oneTimeTokenLogin {
-                    submitPageUrl = "/ott/submit"
+                    defaultSubmitPageUrl = "/ott/submit"
                 }
             }
             return http.build()

docs/modules/ROOT/pages/servlet/integrations/concurrency.adoc

@@ -150,7 +150,7 @@ This means that we are running our `Runnable` with the same user that was used t
 
 == Spring Security Concurrency Classes
 
-See the {security-api-url}index.html[Javadoc] for additional integrations with both the Java concurrent APIs and the Spring Task abstractions.
+See the xref:attachment$api/java/index.html[Javadoc] for additional integrations with both the Java concurrent APIs and the Spring Task abstractions.
 They are self-explanatory once you understand the previous code.
 
 * javadoc:org.springframework.security.concurrent.DelegatingSecurityContextCallable[]

docs/modules/ROOT/pages/servlet/oauth2/authorization-server/core-model-components.adoc

@@ -178,13 +178,13 @@ An `OAuth2Authorization` is a representation of an OAuth2 authorization, which h
 [TIP]
 The corresponding authorization model in Spring Security's OAuth2 Client support is xref:servlet/oauth2/client/core.adoc#oauth2Client-authorized-client[OAuth2AuthorizedClient].
 
-After the successful completion of an authorization grant flow, an `OAuth2Authorization` is created and associates an {security-api-url}/org/springframework/security/oauth2/core/OAuth2AccessToken.html[`OAuth2AccessToken`], an (optional) {security-api-url}/org/springframework/security/oauth2/core/OAuth2RefreshToken.html[`OAuth2RefreshToken`], and additional state specific to the executed authorization grant type.
+After the successful completion of an authorization grant flow, an `OAuth2Authorization` is created and associates an javadoc:org.springframework.security.oauth2.core.OAuth2AccessToken[], an (optional) javadoc:org.springframework.security.oauth2.core.OAuth2RefreshToken[], and additional state specific to the executed authorization grant type.
 
-The {security-api-url}/org/springframework/security/oauth2/core/OAuth2Token.html[`OAuth2Token`] instances associated with an `OAuth2Authorization` vary, depending on the authorization grant type.
+The javadoc:org.springframework.security.oauth2.core.OAuth2Token[] instances associated with an `OAuth2Authorization` vary, depending on the authorization grant type.
 
 For the OAuth2 https://datatracker.ietf.org/doc/html/rfc6749#section-4.1[authorization_code grant], an `OAuth2AuthorizationCode`, an `OAuth2AccessToken`, and an (optional) `OAuth2RefreshToken` are associated.
 
-For the OpenID Connect 1.0 https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[authorization_code grant], an `OAuth2AuthorizationCode`, an {security-api-url}/org/springframework/security/oauth2/core/oidc/OidcIdToken.html[`OidcIdToken`], an `OAuth2AccessToken`, and an (optional) `OAuth2RefreshToken` are associated.
+For the OpenID Connect 1.0 https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[authorization_code grant], an `OAuth2AuthorizationCode`, an javadoc:org.springframework.security.oauth2.core.oidc.OidcIdToken[], an `OAuth2AccessToken`, and an (optional) `OAuth2RefreshToken` are associated.
 
 For the OAuth2 https://datatracker.ietf.org/doc/html/rfc6749#section-4.4[client_credentials grant], only an `OAuth2AccessToken` is associated.
 

docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc

@@ -277,9 +277,9 @@ This is a minimal configuration for getting started quickly. To understand what
 
 <1> A Spring Security filter chain for the xref:servlet/oauth2/authorization-server/protocol-endpoints.adoc[Protocol Endpoints].
 <2> A Spring Security filter chain for xref:servlet/authentication/index.adoc#servlet-authentication[authentication].
-<3> An instance of {security-api-url}/org/springframework/security/core/userdetails/UserDetailsService.html[`UserDetailsService`] for retrieving users to authenticate.
+<3> An instance of javadoc:org.springframework.security.core.userdetails.UserDetailsService[] for retrieving users to authenticate.
 <4> An instance of xref:servlet/oauth2/authorization-server/core-model-components.adoc#oauth2AuthorizationServer-registered-client-repository[`RegisteredClientRepository`] for managing clients.
 <5> An instance of `com.nimbusds.jose.jwk.source.JWKSource` for signing access tokens.
 <6> An instance of `java.security.KeyPair` with keys generated on startup used to create the `JWKSource` above.
-<7> An instance of {security-api-url}/org/springframework/security/oauth2/jwt/JwtDecoder.html[`JwtDecoder`] for decoding signed access tokens.
+<7> An instance of javadoc:org.springframework.security.oauth2.jwt.JwtDecoder[] for decoding signed access tokens.
 <8> An instance of xref:servlet/oauth2/authorization-server/configuration-model.adoc#oauth2AuthorizationServer-configuring-authorization-server-settings[`AuthorizationServerSettings`] to configure Spring Security Authorization Server.