From fa92ce375899434c84065ae298d8c49a478a8c52 Mon Sep 17 00:00:00 2001 From: Tran Ngoc Nhan Date: Wed, 12 Aug 2026 04:30:52 +0700 Subject: [PATCH 1/4] Remove Unnecessary `AuthorizationDecision` Cast Closes gh-19282 --- .../security/config/annotation/web/builders/WebSecurity.java | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java b/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java index 05e586c061..544e646df3 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java +++ b/config/src/main/java/org/springframework/security/config/annotation/web/builders/WebSecurity.java @@ -379,9 +379,8 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder authorizationManager = authorization.getAuthorizationManager(); - builder.add(securityFilterChain::matches, - (authentication, context) -> (AuthorizationDecision) authorizationManager - .authorize(authentication, context.getRequest())); + builder.add(securityFilterChain::matches, (authentication, context) -> authorizationManager + .authorize(authentication, context.getRequest())); mappings = true; } } From 863753580c34857b7dbf8c73308ec31eb3db9e3e Mon Sep 17 00:00:00 2001 From: Tran Ngoc Nhan Date: Mon, 1 Jun 2026 20:33:43 +0700 Subject: [PATCH 2/4] Fix Broken `DefaultLoginPageGeneratingFilter` Javadoc Link Use the `javadoc:` macro so the reference resolves correctly. Signed-off-by: Tran Ngoc Nhan --- .../modules/ROOT/pages/servlet/authentication/onetimetoken.adoc | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc b/docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc index f78f60a8a2..66fc7f7f61 100644 --- a/docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc +++ b/docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc @@ -42,7 +42,7 @@ In the following sections we will explore how to configure OTT Login for your ne [[default-pages]] == Default Login Page and Default One-Time Token Submit Page -When the `oneTimeTokenLogin()` DSL is used, by default the One-Time Token Login Page is auto-generated by the org.springframework.security.web.authentication.ui:DefaultLoginPageGeneratingFilter[]. +When the `oneTimeTokenLogin()` DSL is used, by default the One-Time Token Login Page is auto-generated by the javadoc:org.springframework.security.web.authentication.ui.DefaultLoginPageGeneratingFilter[]. The DSL will also set up the javadoc:org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter[] to generate a default One-Time Token submit page. [[sending-token-to-user]] From 24aec1d002e283a095df5f427cbe35c1794b03aa Mon Sep 17 00:00:00 2001 From: Tran Ngoc Nhan Date: Wed, 20 May 2026 20:36:34 +0700 Subject: [PATCH 3/4] Fix broken Javadoc links Closes gh-19194 Signed-off-by: Tran Ngoc Nhan --- docs/modules/ROOT/pages/servlet/appendix/faq.adoc | 2 +- .../ROOT/pages/servlet/integrations/concurrency.adoc | 2 +- .../oauth2/authorization-server/core-model-components.adoc | 6 +++--- .../oauth2/authorization-server/getting-started.adoc | 4 ++-- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/docs/modules/ROOT/pages/servlet/appendix/faq.adoc b/docs/modules/ROOT/pages/servlet/appendix/faq.adoc index 438082ac14..5f38f78868 100644 --- a/docs/modules/ROOT/pages/servlet/appendix/faq.adoc +++ b/docs/modules/ROOT/pages/servlet/appendix/faq.adoc @@ -695,7 +695,7 @@ class MyAuthoritiesPopulator : LdapAuthoritiesPopulator { You would then add a bean of this type to your application context and inject it into the `LdapAuthenticationProvider`. This is covered in the section on configuring LDAP by using explicit Spring beans in the LDAP chapter of the reference manual. Note that you cannot use the namespace for configuration in this case. -You should also consult the {security-api-url}[Javadoc] for the relevant classes and interfaces. +You should also consult the xref:attachment$api/java/index.html[Javadoc] for the relevant classes and interfaces. [[appendix-faq-namespace-post-processor]] diff --git a/docs/modules/ROOT/pages/servlet/integrations/concurrency.adoc b/docs/modules/ROOT/pages/servlet/integrations/concurrency.adoc index 25753ff4bc..2111014c35 100644 --- a/docs/modules/ROOT/pages/servlet/integrations/concurrency.adoc +++ b/docs/modules/ROOT/pages/servlet/integrations/concurrency.adoc @@ -150,7 +150,7 @@ This means that we are running our `Runnable` with the same user that was used t == Spring Security Concurrency Classes -See the {security-api-url}index.html[Javadoc] for additional integrations with both the Java concurrent APIs and the Spring Task abstractions. +See the xref:attachment$api/java/index.html[Javadoc] for additional integrations with both the Java concurrent APIs and the Spring Task abstractions. They are self-explanatory once you understand the previous code. * javadoc:org.springframework.security.concurrent.DelegatingSecurityContextCallable[] diff --git a/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/core-model-components.adoc b/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/core-model-components.adoc index 9bb03668ae..5c3299fa1b 100644 --- a/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/core-model-components.adoc +++ b/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/core-model-components.adoc @@ -144,13 +144,13 @@ An `OAuth2Authorization` is a representation of an OAuth2 authorization, which h [TIP] The corresponding authorization model in Spring Security's OAuth2 Client support is xref:servlet/oauth2/client/core.adoc#oauth2Client-authorized-client[OAuth2AuthorizedClient]. -After the successful completion of an authorization grant flow, an `OAuth2Authorization` is created and associates an {security-api-url}/org/springframework/security/oauth2/core/OAuth2AccessToken.html[`OAuth2AccessToken`], an (optional) {security-api-url}/org/springframework/security/oauth2/core/OAuth2RefreshToken.html[`OAuth2RefreshToken`], and additional state specific to the executed authorization grant type. +After the successful completion of an authorization grant flow, an `OAuth2Authorization` is created and associates an javadoc:org.springframework.security.oauth2.core.OAuth2AccessToken[], an (optional) javadoc:org.springframework.security.oauth2.core.OAuth2RefreshToken[], and additional state specific to the executed authorization grant type. -The {security-api-url}/org/springframework/security/oauth2/core/OAuth2Token.html[`OAuth2Token`] instances associated with an `OAuth2Authorization` vary, depending on the authorization grant type. +The javadoc:org.springframework.security.oauth2.core.OAuth2Token[] instances associated with an `OAuth2Authorization` vary, depending on the authorization grant type. For the OAuth2 https://datatracker.ietf.org/doc/html/rfc6749#section-4.1[authorization_code grant], an `OAuth2AuthorizationCode`, an `OAuth2AccessToken`, and an (optional) `OAuth2RefreshToken` are associated. -For the OpenID Connect 1.0 https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[authorization_code grant], an `OAuth2AuthorizationCode`, an {security-api-url}/org/springframework/security/oauth2/core/oidc/OidcIdToken.html[`OidcIdToken`], an `OAuth2AccessToken`, and an (optional) `OAuth2RefreshToken` are associated. +For the OpenID Connect 1.0 https://openid.net/specs/openid-connect-core-1_0.html#CodeFlowAuth[authorization_code grant], an `OAuth2AuthorizationCode`, an javadoc:org.springframework.security.oauth2.core.oidc.OidcIdToken[], an `OAuth2AccessToken`, and an (optional) `OAuth2RefreshToken` are associated. For the OAuth2 https://datatracker.ietf.org/doc/html/rfc6749#section-4.4[client_credentials grant], only an `OAuth2AccessToken` is associated. diff --git a/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc b/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc index 8a3a88c8a3..395d68f0de 100644 --- a/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc +++ b/docs/modules/ROOT/pages/servlet/oauth2/authorization-server/getting-started.adoc @@ -277,9 +277,9 @@ This is a minimal configuration for getting started quickly. To understand what <1> A Spring Security filter chain for the xref:servlet/oauth2/authorization-server/protocol-endpoints.adoc[Protocol Endpoints]. <2> A Spring Security filter chain for xref:servlet/authentication/index.adoc#servlet-authentication[authentication]. -<3> An instance of {security-api-url}/org/springframework/security/core/userdetails/UserDetailsService.html[`UserDetailsService`] for retrieving users to authenticate. +<3> An instance of javadoc:org.springframework.security.core.userdetails.UserDetailsService[] for retrieving users to authenticate. <4> An instance of xref:servlet/oauth2/authorization-server/core-model-components.adoc#oauth2AuthorizationServer-registered-client-repository[`RegisteredClientRepository`] for managing clients. <5> An instance of `com.nimbusds.jose.jwk.source.JWKSource` for signing access tokens. <6> An instance of `java.security.KeyPair` with keys generated on startup used to create the `JWKSource` above. -<7> An instance of {security-api-url}/org/springframework/security/oauth2/jwt/JwtDecoder.html[`JwtDecoder`] for decoding signed access tokens. +<7> An instance of javadoc:org.springframework.security.oauth2.jwt.JwtDecoder[] for decoding signed access tokens. <8> An instance of xref:servlet/oauth2/authorization-server/configuration-model.adoc#oauth2AuthorizationServer-configuring-authorization-server-settings[`AuthorizationServerSettings`] to configure Spring Security Authorization Server. From 63306ad8ee7f9ec7792bed0075043ea9e4f130a4 Mon Sep 17 00:00:00 2001 From: Arz Meow Date: Fri, 5 Jun 2026 11:37:22 +0800 Subject: [PATCH 4/4] Update One-Time Token Docs for Renamed APIs Replace deprecated `UriComponentsBuilder` usage and renamed `oneTimeTokenLogin` DSL method references in the docs with their current equivalents. Closes gh-18367 Signed-off-by: Arz Meow --- .../pages/servlet/authentication/onetimetoken.adoc | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc b/docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc index 66fc7f7f61..7187526146 100644 --- a/docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc +++ b/docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc @@ -89,7 +89,7 @@ public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTok @Override public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException { - UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request)) + UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(request.getRequestURL().toString()) .replacePath(request.getContextPath()) .replaceQuery(null) .fragment(null) @@ -147,7 +147,7 @@ class MagicLinkOneTimeTokenGenerationSuccessHandler( ) : OneTimeTokenGenerationSuccessHandler { override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) { - val builder = UriComponentsBuilder.fromHttpUrl(UrlUtils.buildFullRequestUrl(request)) + val builder = UriComponentsBuilder.fromUriString(request.getRequestURL().toString()) .replacePath(request.contextPath) .replaceQuery(null) .fragment(null) @@ -211,7 +211,7 @@ public class SecurityConfig { // ... .formLogin(Customizer.withDefaults()) .oneTimeTokenLogin((ott) -> ott - .generateTokenUrl("/ott/my-generate-url") + .tokenGeneratingUrl("/ott/my-generate-url") ); return http.build(); } @@ -238,7 +238,7 @@ class SecurityConfig { //... formLogin { } oneTimeTokenLogin { - generateTokenUrl = "/ott/my-generate-url" + tokenGeneratingUrl = "/ott/my-generate-url" } } return http.build() @@ -282,7 +282,7 @@ public class SecurityConfig { // ... .formLogin(Customizer.withDefaults()) .oneTimeTokenLogin((ott) -> ott - .submitPageUrl("/ott/submit") + .defaultSubmitPageUrl("/ott/submit") ); return http.build(); } @@ -309,7 +309,7 @@ class SecurityConfig { //... formLogin { } oneTimeTokenLogin { - submitPageUrl = "/ott/submit" + defaultSubmitPageUrl = "/ott/submit" } } return http.build()