cfdadfea01
Apply Builder Bean Only to Application Endpoints
...
A published PathPatternRequestMatcher.Builder bean is intended to align
application endpoint matchers, which commonly are from the same servlet.
This commit ensures that this bean is used by securityMatcher(s),
authorizeHttpRequests, and WebSecurity#ignoring, which target
application endpoints typically served by servlets.
This commit also adds tests ensuring that the bean is not applied to filter-chain
security endpoints such as those configured by formLogin, logout,
oneTimeTokenLogin, OAuth 2.0 Login, and SAML 2.0 Login, since
these endpoints are, by default, handled by filters independent from
any target servlet and servlet path.
Closes gh-19128
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-05-22 21:36:19 -06:00
6020ab8e65
Polish CustomAuthorizationManager Docs
...
Issue gh-13967
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-27 16:36:00 -06:00
3076367168
Fix documentation for Custom Authorization Manager
...
Closes gh-13967
Signed-off-by: as1605 <1605.aditya.singh@gmail.com >
2026-03-27 16:36:00 -06:00
e6db4418b0
Merge branch '6.5.x' into 7.0.x
2026-03-27 13:22:44 -06:00
835d6c1fbd
Add Issuer Validation to withIssuerLocation Snippets
...
Closes gh-19000
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-27 13:22:24 -06:00
956561e143
Merge branch '6.5.x' into 7.0.x
2026-03-20 15:28:36 -06:00
9fed1ac8c3
New line per sentence
...
Signed-off-by: Rob Winch <362503+rwinch@users.noreply.github.com >
2026-03-20 15:28:21 -06:00
9dbe3bdcc0
Polish Session Management Persistence Docs
...
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-03-20 15:28:21 -06:00
d547ae0181
Fix defaults description in Session Management doc
...
Corrected that starting from Spring Security 6
security context is not automatically saved by default.
Signed-off-by: sankranti <sankranty@gmail.com >
2026-03-20 15:28:21 -06:00
26937bf06c
Remove unnecessary webauthn4j dependency
2026-03-09 14:25:08 -05:00
8e8e1a80a9
Add Passkeys webauthn in example
...
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-03-09 14:23:14 -05:00
57434fc597
Update RestTemplateBuilder usage in opaque-token.adoc
...
We just now use a new form instead of the deprecate one.
Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com >
2026-03-03 16:48:22 -07:00
20a7f96062
Merge branch '6.5.x' into 7.0.x
2026-03-03 16:44:12 -07:00
706b059ea8
Update logout.adoc
...
Directives should be Directive
Signed-off-by: HaiYan <haiyan_qi@hotmail.com >
2026-03-03 16:43:18 -07:00
c29af014f4
Merge remote-tracking branch 'origin/6.5.x' into 7.0.x
2026-02-26 17:10:16 -07:00
4501ae7d1c
Update Reactive Resource Server startup exceptations
...
Issue gh-16708
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-02-26 16:56:22 -07:00
48112d3d74
Polish Resource Server startup expectations
...
Issue gh-16708
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-02-26 16:56:22 -07:00
b8735abb63
Clarify Resource Server startup expectations
...
Clarify that Spring Boot defers OIDC discovery by default.
Closes gh-16708
Signed-off-by: [CLOUD4] 한현 <gusgus1467@naver.com >
2026-02-26 16:56:22 -07:00
7c3c8bbdcb
Update Remember-Me example
...
Closes gh-18639
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-02-26 15:28:32 -07:00
731848d5d3
Merge branch '6.5.x' into 7.0.x
2026-02-26 15:09:45 -07:00
68a02ff176
Update Link to CRSF Docs in FAQ
...
Signed-off-by: Guillaume Husta <guillaume.husta@gmail.com >
2026-02-26 14:47:21 -07:00
73ee893d98
Merge remote-tracking branch 'origin/6.5.x' into 7.0.x
2026-02-24 17:10:14 -07:00
4d43edfb20
Polish Documentation
...
- Combined explanation of method attribute with usage recommendations
- Used one sentence per line format
Issue gh-16530
Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com >
2026-02-24 14:24:11 -07:00
9f9699f8a5
Clarify need for method attribute in JSP authorize tag
...
Closes gh-16530
This aligns the JSP documentation with the changes made in gh-16529.
Added a NOTE to clarify that the method attribute is required when the underlying RequestMatcher is method-specific.
Signed-off-by: onhann <gusgus1467@naver.com >
2026-02-24 14:24:11 -07:00
fec988c82d
Add Kerberos Migration Section
...
This links to the updated dependency coordinates
Issue gh-18773
Signed-off-by: Robert Winch <362503+rwinch@users.noreply.github.com >
2026-02-23 11:29:50 -06:00
17b434c1c1
Document the change in dependency coordinates with Spring Security 7
...
Signed-off-by: busoco-sjb <169069865+busoco-sjb@users.noreply.github.com >
2026-02-23 11:21:59 -06:00
075c48c0d8
Fix typo in documentation
...
Signed-off-by: Vincent Stradiot <vincentstradiot@hotmail.com >
2026-02-05 17:22:43 -07:00
2c97b3376b
Document Client PKCE settings
...
Updated the documentation to reflect recent changes to enable PKCE by default for `authorization_code` flows in the documentation for the client.
Closes gh-18304
Signed-off-by: Elayne Bloom <5840349+bloomsei@users.noreply.github.com >
2026-02-02 16:30:27 -05:00
1f39a3dd3e
Merge branch '6.5.x' into 7.0.x
2026-01-15 12:41:22 -07:00
84b124d29d
Merge branch '6.4.x' into 6.5.x
2026-01-15 12:41:16 -07:00
fee6a9bb0e
docs: add CurrentSecurityContext section and link references
...
Signed-off-by: songhee <songhee9327@gmail.com >
2026-01-15 12:31:58 -07:00
508b3f26e3
docs: Typo in page Preparing for 7.0 / Web (version 6.5)
...
In section 'Include the Servlet Path Prefix in Authorization Rules', `PathPatternRequestParser` should be replaced by `PathPatternRequestMatcher`.
Signed-off-by: Guillaume Husta <guillaume.husta@gmail.com >
2026-01-14 14:35:26 -07:00
63c99b9438
Revert "Update to 7.1.0-SNAPSHOT"
...
This reverts commit b77ea8d3a3
2026-01-12 14:31:57 -06:00
b77ea8d3a3
Update to 7.1.0-SNAPSHOT
2026-01-12 13:37:32 -06:00
e9a92a8e9a
Replacing use of deprecated 'check' in authorization documentation
...
check() was deprecated in Spring Security 7, but is referenced in documentation
Signed-off-by: Fr05ty-hub <frostylucas@gmail.com >
2026-01-09 15:27:00 -06:00
ed774d3595
Replacing use of deprecated 'check' in authorization documentation
...
check() was deprecated in Spring Security 7, but was referenced in documentation
Signed-off-by: Fr05ty-hub <frostylucas@gmail.com >
2026-01-09 15:27:00 -06:00
2344fe5ebb
Use proper xref syntax
...
Incldue the required resource id and required # of the fragment.
See
- https://docs.antora.org/antora/latest/page/xref/#xref-macro
- https://docs.antora.org/antora/latest/page/resource-id-coordinates/#id-resource
2026-01-09 09:21:02 -06:00
ba18f681e5
Use xref anchor id
...
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-01-09 09:21:02 -06:00
3d9bc6a5cf
Update mfa.adoc
...
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-01-09 09:21:02 -06:00
1d8ea63a9e
Fix typo in HTTP Basic Auth Provider documentation
...
The documentation states that setting the header `X-Requested-By` will remove the `WWW-Authenticate` header from the response.
However, after testing this and reading the library code it looks like the header to set is `X-Requested-With` (X-Requested-By is mentioned nowhere except in this documentation file), so I propose this simple PR to fix this.
Signed-off-by: Martin Boulais <31805063+martinboulais@users.noreply.github.com >
2026-01-08 13:59:34 -06:00
79815e044e
Fix typos
...
Signed-off-by: Tran Ngoc Nhan <ngocnhan.tran1996@gmail.com >
2026-01-08 13:35:43 -06:00
765abe534e
Add Missing Migration Pages to Side Navigation
...
Closes gh-18313
2025-12-15 09:05:06 -07:00
afb0c59875
Add request-matcher XML Migration Steps
...
Closes gh-18211
2025-12-15 09:05:06 -07:00
10edc14d7e
Fix typo in AnnotationTemplateExpressionDefaults
...
The AnnotationTemplateExpressionDeafults was wrong，and right is AnnotationTemplateExpressionDefaults
Signed-off-by: kucoll <kucoll@163.com >
2025-12-02 17:26:34 -06:00
7503d8018d
Fix typo in AnnotationTemplateExpressionDefaults
...
The AnnotationTemplateExpressionDeafults was wrong，and right is AnnotationTemplateExpressionDefaults
Signed-off-by: kucoll <kucoll@163.com >
2025-12-02 17:22:12 -06:00
1ce73dd45a
docs: Fix example in Custom DSLs for http.csrf()
...
It should use lambda dsl to compile
Signed-off-by: Guillaume Husta <guillaume.husta@gmail.com >
2025-12-01 18:02:41 -06:00
bb7fcb27ef
docs: Fix example in MyCustomDsl to remove throws Exception
...
In `init` and `configure`, throws Exception has been removed in the super interface `SecurityConfigurer`, since Spring Security 7.0.
This change is the consequence of https://github.com/spring-projects/spring-security/issues/17957
Signed-off-by: Guillaume Husta <guillaume.husta@gmail.com >
2025-12-01 17:59:07 -06:00
19cbd9c570
Update OAuth2 Client to OAuth2 Resource Server
...
Fix section title to match the corresponding example
Signed-off-by: sach429 <satrajit.acharya@gmail.com >
2025-12-01 17:42:28 -06:00
b37c5584f9
Fix broken link to Spring Boot docs
...
Signed-off-by: L33gn21 <l33gn21@gmail.com >
2025-12-01 16:52:43 -06:00
d84d0ca22e
Fix typo in ldap.adoc
...
Signed-off-by: Peter Potrowl <peter.potrowl@gmail.com >
2025-11-21 10:33:48 -06:00
Josh Cummings