Fix Formatting and Style

Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>
throw original exception to keep compatibility with common RestTemplate
2026-09-05 08:49:54 +00:00 · 2026-09-04 09:10:59 -07:00 · 2026-09-04 09:10:59 -07:00 · 2026-09-04 09:02:35 -06:00 · 2026-09-04 09:01:11 -06:00 · 2026-09-04 08:54:23 -06:00
1233 changed files with 8115 additions and 2784 deletions
@@ -4,52 +4,6 @@ registries:
    type: maven-repository
    url: https://build.shibboleth.net/maven/releases
 updates:
-  # 6.5.x
-  - package-ecosystem: gradle
-    target-branch: 6.5.x
-    directory: /
-    schedule:
-      interval: daily
-      time: '03:00'
-      timezone: Etc/UTC
-    labels:
-      - 'type: dependency-upgrade'
-      - 'in: build'
-    registries:
-      - shibboleth
-    ignore:
-      - dependency-name: com.nimbusds:nimbus-jose-jwt
-      - dependency-name: org.python:jython
-      - dependency-name: org.apache.directory.server:*
-      - dependency-name: org.apache.directory.shared:*
-      - dependency-name: org.junit:junit-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: org.mockito:mockito-bom
-        update-types:
-          - version-update:semver-major
-      - dependency-name: '*'
-        update-types:
-          - version-update:semver-major
-          - version-update:semver-minor
-  - package-ecosystem: npm
-    target-branch: 6.5.x
-    directory: /docs
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'
-  - package-ecosystem: github-actions
-    target-branch: 6.5.x
-    directory: /
-    schedule:
-      interval: weekly
-    labels:
-      - 'type: task'
-      - 'type: dependency-upgrade'
-      - 'in: build'

  # 7.0.x
  - package-ecosystem: gradle
@@ -103,6 +57,57 @@ updates:
      - 'type: dependency-upgrade'
      - 'in: build'

+  # 7.1.x
+  - package-ecosystem: gradle
+    target-branch: 7.1.x
+    directory: /
+    schedule:
+      interval: daily
+      time: '03:00'
+      timezone: Etc/UTC
+    labels:
+      - 'type: dependency-upgrade'
+      - 'in: build'
+    registries:
+      - shibboleth
+    ignore:
+      - dependency-name: com.nimbusds:nimbus-jose-jwt
+      - dependency-name: org.python:jython
+      - dependency-name: org.apache.directory.server:*
+      - dependency-name: org.apache.directory.shared:*
+      - dependency-name: org.junit:junit-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: org.mockito:mockito-bom
+        update-types:
+          - version-update:semver-major
+      - dependency-name: com.gradle.enterprise
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+      - dependency-name: '*'
+        update-types:
+          - version-update:semver-major
+          - version-update:semver-minor
+  - package-ecosystem: npm
+    target-branch: 7.1.x
+    directory: /docs
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'type: dependency-upgrade'
+      - 'in: build'
+  - package-ecosystem: github-actions
+    target-branch: 7.1.x
+    directory: /
+    schedule:
+      interval: weekly
+    labels:
+      - 'type: task'
+      - 'type: dependency-upgrade'
+      - 'in: build'
+
  # main
  - package-ecosystem: gradle
    target-branch: main
@@ -0,0 +1,16 @@
+name: Merge Dependabot PR
+
+on:
+  pull_request:
+    branches:
+      - main
+      - 'docs-build'
+
+run-name: Merge Dependabot PR ${{ github.ref_name }}
+
+jobs:
+  merge-dependabot-pr:
+    permissions: write-all
+    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@0d3f15bb384839966a1ff5c4383731a2b747f24b # v7
+    with:
+      mergeArguments: --auto --rebase
@@ -17,7 +17,7 @@ jobs:
    runs-on: ubuntu-latest
    strategy:
      matrix:
-        branch: [ '6.5.x', '7.0.x', 'main' ]
+        branch: [ '6.5.x', '7.0.x', '7.1.x', 'main' ]
    steps:
      - uses: spring-io/spring-doc-actions/update-antora-spring-ui@415e2b11a766ba64799fffb5c97a4f7e17f677cf # v0.0.22
        name: Update
@@ -90,7 +90,7 @@ public class ExpressionBasedAnnotationAttributeFactory implements PrePostInvocat
 	}

 	/**
-	 * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136.
+	 * Delay the lookup of the {@link ExpressionParser} to prevent SEC-2136
 	 * @return
 	 */
 	private ExpressionParser getParser() {
@@ -30,9 +30,6 @@ import org.springframework.security.access.prepost.PostInvocationAuthorizationAd
 import org.springframework.security.core.Authentication;

 /**
- * A {@link PostInvocationAuthorizationAdvice} that applies {@code PostFilter} and
- * {@code PostAuthorize} expressions.
- *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -23,8 +23,6 @@ import org.springframework.expression.ParseException;
 import org.springframework.security.access.prepost.PostInvocationAttribute;

 /**
- * A {@link PostInvocationAttribute} based on filter and authorize expressions.
- *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -23,8 +23,6 @@ import org.springframework.expression.ParseException;
 import org.springframework.security.access.prepost.PreInvocationAttribute;

 /**
- * A {@link PreInvocationAttribute} based on parsed {@link Expression}s.
- *
 * @author Luke Taylor
 * @since 3.0
 * @deprecated Use
@@ -59,12 +59,12 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	private @Nullable ClassLoader beanClassLoader = ClassUtils.getDefaultClassLoader();

 	/**
-	 * Map from RegisteredMethod to ConfigAttribute list.
+	 * Map from RegisteredMethod to ConfigAttribute list
 	 */
 	protected final Map<RegisteredMethod, List<ConfigAttribute>> methodMap = new HashMap<>();

 	/**
-	 * Map from RegisteredMethod to name pattern used for registration.
+	 * Map from RegisteredMethod to name pattern used for registration
 	 */
 	private final Map<RegisteredMethod, String> nameMap = new HashMap<>();

@@ -72,7 +72,7 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	}

 	/**
-	 * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a.
+	 * Creates the <tt>MapBasedMethodSecurityMetadataSource</tt> from a
 	 * @param methodMap map of method names to <tt>ConfigAttribute</tt>s.
 	 */
 	public MapBasedMethodSecurityMetadataSource(Map<String, List<ConfigAttribute>> methodMap) {
@@ -236,7 +236,6 @@ public class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethod
 	}

 	/**
-	 * Returns the size of the method map.
 	 * @return map size (for unit tests and diagnostics)
 	 */
 	public int getMethodMapSize() {
@@ -41,7 +41,7 @@ import org.springframework.security.core.parameters.AnnotationParameterNameDisco
 public @interface P {

 	/**
-	 * The parameter name.
+	 * The parameter name
 	 * @return
 	 */
 	String value();
@@ -74,7 +74,7 @@ public class PrePostAdviceReactiveMethodInterceptor implements MethodInterceptor
 	private static final int RETURN_TYPE_METHOD_PARAMETER_INDEX = -1;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param attributeSource the {@link MethodSecurityMetadataSource} to use
 	 * @param preInvocationAdvice the {@link PreInvocationAuthorizationAdvice} to use
 	 * @param postInvocationAdvice the {@link PostInvocationAuthorizationAdvice} to use
@@ -22,9 +22,6 @@ import org.springframework.aop.framework.AopInfrastructureBean;
 import org.springframework.security.authorization.AuthorizationManager;

 /**
- * A factory for creating {@link PreInvocationAttribute}s and
- * {@link PostInvocationAttribute}s.
- *
 * @author Luke Taylor
 * @since 3.0
 * @see org.springframework.security.authorization.method.AuthorizationManagerBeforeMethodInterceptor
@@ -19,7 +19,7 @@ package org.springframework.security.messaging.access.expression;
 import org.springframework.expression.EvaluationContext;

 /**
- * Allows post processing the {@link EvaluationContext}.
+ * Allows post processing the {@link EvaluationContext}
 *
 * <p>
 * This API is intentionally kept package scope as it may evolve over time.
@@ -46,7 +46,7 @@ class MessageExpressionConfigAttribute implements ConfigAttribute, EvaluationCon
 	private final MessageMatcher<Object> matcher;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param authorizeExpression the {@link Expression} to use. Cannot be null
 	 * @param matcher the {@link MessageMatcher} used to match the messages.
 	 */
@@ -48,7 +48,7 @@ public final class ChannelSecurityInterceptor extends AbstractSecurityIntercepto
 	private final MessageSecurityMetadataSource metadataSource;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param metadataSource the MessageSecurityMetadataSource to use. Cannot be null.
 	 *
 	 * @see DefaultMessageSecurityMetadataSource
@@ -20,7 +20,7 @@ import org.springframework.messaging.Message;
 import org.springframework.security.access.SecurityMetadataSource;

 /**
- * A {@link SecurityMetadataSource} that is used for securing {@link Message}.
+ * A {@link SecurityMetadataSource} that is used for securing {@link Message}
 *
 * @author Rob Winch
 * @since 4.0
@@ -32,8 +32,6 @@ import org.springframework.security.web.RedirectStrategy;
 import org.springframework.util.Assert;

 /**
- * A {@link ChannelEntryPoint} that retries the request on a different scheme and port.
- *
 * @author Luke Taylor
 * @deprecated please use
 * {@link org.springframework.security.web.transport.HttpsRedirectFilter} and its
@@ -47,12 +45,12 @@ public abstract class AbstractRetryEntryPoint implements ChannelEntryPoint {
 	private PortMapper portMapper = new PortMapperImpl();

 	/**
-	 * The scheme ("http://" or "https://").
+	 * The scheme ("http://" or "https://")
 	 */
 	private final String scheme;

 	/**
-	 * The standard port for the scheme (80 for http, 443 for https).
+	 * The standard port for the scheme (80 for http, 443 for https)
 	 */
 	private final int standardPort;

@@ -28,8 +28,6 @@ import org.springframework.security.core.Authentication;
 import org.springframework.security.web.FilterInvocation;

 /**
- * The default implementation of {@link SecurityExpressionHandler} for web security.
- *
 * @author Luke Taylor
 * @author Eddú Meléndez
 * @author Steve Riesenberg
@@ -54,7 +54,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 	private boolean observeOncePerRequest = false;

 	/**
-	 * Not used (we rely on IoC container lifecycle services instead).
+	 * Not used (we rely on IoC container lifecycle services instead)
 	 * @param arg0 ignored
 	 *
 	 */
@@ -63,7 +63,7 @@ public class FilterSecurityInterceptor extends AbstractSecurityInterceptor imple
 	}

 	/**
-	 * Not used (we rely on IoC container lifecycle services instead).
+	 * Not used (we rely on IoC container lifecycle services instead)
 	 */
 	@Override
 	public void destroy() {
@@ -141,7 +141,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	private AclClassIdUtils aclClassIdUtils;

 	/**
-	 * Constructor accepting mandatory arguments.
+	 * Constructor accepting mandatory arguments
 	 * @param dataSource to access the database
 	 * @param aclCache the cache where fully-loaded elements can be stored
 	 * @param aclAuthorizationStrategy authorization strategy (required)
@@ -152,7 +152,7 @@ public class BasicLookupStrategy implements LookupStrategy {
 	}

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param dataSource to access the database
 	 * @param aclCache the cache where fully-loaded elements can be stored
 	 * @param aclAuthorizationStrategy authorization strategy (required)
@@ -565,7 +565,7 @@ public class BasicLookupStrategy implements LookupStrategy {

 		/**
 		 * Accepts the current <code>ResultSet</code> row, and converts it into an
-		 * <code>AclImpl</code> that contains a <code>StubAclParent</code>.
+		 * <code>AclImpl</code> that contains a <code>StubAclParent</code>
 		 * @param acls the Map we should add the converted Acl to
 		 * @param rs the ResultSet focused on a current row
 		 * @throws SQLException if something goes wrong converting values
@@ -479,7 +479,6 @@ public class JdbcMutableAclService extends JdbcAclService implements MutableAclS
 	}

 	/**
-	 * Sets whether the database enforces foreign key constraints.
 	 * @param foreignKeysInDatabase if false this class will perform additional FK
 	 * constrain checking, which may cause deadlocks (the default is true, so deadlocks
 	 * are avoided but the database is expected to enforce FKs)
@@ -15,7 +15,7 @@
 */

 /**
- * JDBC-based persistence of ACL information.
+ * JDBC-based persistence of ACL information
 */
@NullMarked
 package org.springframework.security.acls.jdbc;
@@ -37,7 +37,6 @@ import org.jspecify.annotations.Nullable;
 public interface ObjectIdentity extends Serializable {

 	/**
-	 * Compares this <tt>ObjectIdentity</tt> to the given object for equality.
 	 * @param obj to be compared
 	 * @return <tt>true</tt> if the objects are equal, <tt>false</tt> otherwise
 	 * @see Object#equals(Object)
@@ -68,7 +67,6 @@ public interface ObjectIdentity extends Serializable {
 	String getType();

 	/**
-	 * Returns a hash code representation of the <tt>ObjectIdentity</tt>.
 	 * @return a hash code representation of the <tt>ObjectIdentity</tt>
 	 * @see Object#hashCode()
 	 */
@@ -31,8 +31,6 @@ import java.io.Serializable;
 public interface ObjectIdentityGenerator {

 	/**
-	 * Creates an {@link ObjectIdentity} using the supplied identifier and type
-	 * information.
 	 * @param id the identifier of the domain object, not null
 	 * @param type the type of the object (often a class name), not null
 	 * @return the identity constructed using the supplied identifier and type
@@ -18,7 +18,7 @@ package org.springframework.security.acls.model;

 /**
 * Strategy interface that provides the ability to determine which {@link ObjectIdentity}
- * will be returned for a particular domain object.
+ * will be returned for a particular domain object
 *
 * @author Ben Alex
 */
@@ -72,7 +72,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	}

 	/**
-	 * Private constructor for Jackson Deserialization support.
+	 * Private constructor for Jackson Deserialization support
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -182,7 +182,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 	}

 	/**
-	 * A builder of {@link CasAuthenticationToken} instances.
+	 * A builder of {@link CasAuthenticationToken} instances
 	 *
 	 * @since 7.0
 	 */
@@ -208,7 +208,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this key.
+		 * Use this key
 		 * @param key the key to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -232,7 +232,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this {@link UserDetails}.
+		 * Use this {@link UserDetails}
 		 * @param userDetails the {@link UserDetails} to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -242,7 +242,7 @@ public class CasAuthenticationToken extends AbstractAuthenticationToken implemen
 		}

 		/**
-		 * Use this {@link Assertion}.
+		 * Use this {@link Assertion}
 		 * @param assertion the {@link Assertion} to use
 		 * @return the {@link Builder} for further configurations
 		 */
@@ -121,7 +121,7 @@ public class CasServiceTicketAuthenticationToken extends AbstractAuthenticationT
 	}

 	/**
-	 * A builder of {@link CasServiceTicketAuthenticationToken} instances.
+	 * A builder of {@link CasServiceTicketAuthenticationToken} instances
 	 *
 	 * @since 7.0
 	 */
@@ -32,7 +32,6 @@ import org.jspecify.annotations.Nullable;
 public final class NullStatelessTicketCache implements StatelessTicketCache {

 	/**
-	 * Always returns {@code null} since tickets are not stored.
 	 * @return null since we are not storing any tickets.
 	 */
 	@Override
@@ -20,11 +20,9 @@ import java.util.Date;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.authentication.AttributePrincipal;

 /**
@@ -38,14 +36,14 @@ import org.apereo.cas.client.authentication.AttributePrincipal;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = Id.CLASS)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
-		isGetterVisibility = Visibility.NONE)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
 class AssertionImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.validation.AssertionImpl}.
+	 * {@link org.apereo.cas.client.validation.AssertionImpl}
 	 * @param principal the Principal to associate with the Assertion.
 	 * @param validFromDate when the assertion is valid from.
 	 * @param validUntilDate when the assertion is valid to.
@@ -19,11 +19,9 @@ package org.springframework.security.cas.jackson;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.proxy.ProxyRetriever;

 /**
@@ -37,14 +35,14 @@ import org.apereo.cas.client.proxy.ProxyRetriever;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = Id.CLASS)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
-		isGetterVisibility = Visibility.NONE)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
 class AttributePrincipalImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}.
+	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}
 	 * @param name the unique identifier for the principal.
 	 * @param attributes the key/value pairs for this principal.
 	 * @param proxyGrantingTicket the ticket associated with this principal.
@@ -19,11 +19,9 @@ package org.springframework.security.cas.jackson;
 import java.util.Collection;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.validation.Assertion;

 import org.springframework.security.cas.authentication.CasAuthenticationProvider;
@@ -40,13 +38,13 @@ import org.springframework.security.core.userdetails.UserDetails;
 * @see CasJacksonModule
 * @see org.springframework.security.jackson.SecurityJacksonModules
 */
-@JsonTypeInfo(use = Id.CLASS)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, isGetterVisibility = Visibility.NONE,
-		getterVisibility = Visibility.NONE, creatorVisibility = Visibility.ANY)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
+		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
 class CasAuthenticationTokenMixin {

 	/**
-	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}.
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -20,13 +20,10 @@ import java.util.Date;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.authentication.AttributePrincipal;

 /**
@@ -52,15 +49,15 @@ import org.apereo.cas.client.authentication.AttributePrincipal;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
-		isGetterVisibility = Visibility.NONE)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
 class AssertionImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.validation.AssertionImpl}.
+	 * {@link org.apereo.cas.client.validation.AssertionImpl}
 	 * @param principal the Principal to associate with the Assertion.
 	 * @param validFromDate when the assertion is valid from.
 	 * @param validUntilDate when the assertion is valid to.
@@ -19,13 +19,10 @@ package org.springframework.security.cas.jackson2;
 import java.util.Map;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.proxy.ProxyRetriever;

 /**
@@ -50,15 +47,15 @@ import org.apereo.cas.client.proxy.ProxyRetriever;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, getterVisibility = Visibility.NONE,
-		isGetterVisibility = Visibility.NONE)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, getterVisibility = JsonAutoDetect.Visibility.NONE,
+		isGetterVisibility = JsonAutoDetect.Visibility.NONE)
@JsonIgnoreProperties(ignoreUnknown = true)
 class AttributePrincipalImplMixin {

 	/**
 	 * Mixin Constructor helps in deserialize
-	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}.
+	 * {@link org.apereo.cas.client.authentication.AttributePrincipalImpl}
 	 * @param name the unique identifier for the principal.
 	 * @param attributes the key/value pairs for this principal.
 	 * @param proxyGrantingTicket the ticket associated with this principal.
@@ -19,13 +19,10 @@ package org.springframework.security.cas.jackson2;
 import java.util.Collection;

 import com.fasterxml.jackson.annotation.JsonAutoDetect;
-import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
 import com.fasterxml.jackson.annotation.JsonCreator;
 import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
 import com.fasterxml.jackson.annotation.JsonProperty;
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.As;
-import com.fasterxml.jackson.annotation.JsonTypeInfo.Id;
 import org.apereo.cas.client.validation.Assertion;

 import org.springframework.security.cas.authentication.CasAuthenticationProvider;
@@ -58,14 +55,14 @@ import org.springframework.security.core.userdetails.UserDetails;
 */
@SuppressWarnings("removal")
@Deprecated(forRemoval = true)
-@JsonTypeInfo(use = Id.CLASS, include = As.PROPERTY)
-@JsonAutoDetect(fieldVisibility = Visibility.ANY, isGetterVisibility = Visibility.NONE,
-		getterVisibility = Visibility.NONE, creatorVisibility = Visibility.ANY)
+@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
+@JsonAutoDetect(fieldVisibility = JsonAutoDetect.Visibility.ANY, isGetterVisibility = JsonAutoDetect.Visibility.NONE,
+		getterVisibility = JsonAutoDetect.Visibility.NONE, creatorVisibility = JsonAutoDetect.Visibility.ANY)
@JsonIgnoreProperties(ignoreUnknown = true)
 class CasAuthenticationTokenMixin {

 	/**
-	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}.
+	 * Mixin Constructor helps in deserialize {@link CasAuthenticationToken}
 	 * @param keyHash hashCode of provided key to identify if this object made by a given
 	 * {@link CasAuthenticationProvider}
 	 * @param principal typically the UserDetails object (cannot be <code>null</code>)
@@ -155,7 +155,7 @@ public class CasAuthenticationEntryPoint implements AuthenticationEntryPoint, In
 	}

 	/**
-	 * Sets the {@link RedirectStrategy} to use.
+	 * Sets the {@link RedirectStrategy} to use
 	 * @param redirectStrategy the {@link RedirectStrategy} to use
 	 * @since 6.3
 	 */
@@ -69,7 +69,7 @@ public final class CasGatewayAuthenticationRedirectFilter extends GenericFilterB
 	private RedirectStrategy redirectStrategy = new DefaultRedirectStrategy();

 	/**
-	 * Constructs a new instance of this class.
+	 * Constructs a new instance of this class
 	 * @param serviceProperties the {@link ServiceProperties}
 	 */
 	public CasGatewayAuthenticationRedirectFilter(String casLoginUrl, ServiceProperties serviceProperties) {
@@ -44,7 +44,7 @@ final class DefaultServiceAuthenticationDetails extends WebAuthenticationDetails
 	private final String serviceUrl;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param request the current {@link HttpServletRequest} to obtain the
 	 * {@link #getServiceUrl()} from.
 	 * @param artifactPattern the {@link Pattern} that will be used to clean up the query
@@ -53,7 +53,7 @@ public class ServiceAuthenticationDetailsSource
 	}

 	/**
-	 * Creates an implementation that uses the specified artifactParameterName.
+	 * Creates an implementation that uses the specified artifactParameterName
 	 * @param serviceProperties The ServiceProperties to use to construct the serviceUrl.
 	 * @param artifactParameterName the artifactParameterName that is removed from the
 	 * current URL. The result becomes the service url. Cannot be null and cannot be an
@@ -66,7 +66,6 @@ public class ServiceAuthenticationDetailsSource
 	}

 	/**
-	 * Builds the {@code ServiceAuthenticationDetails} from the given request.
 	 * @param context the {@code HttpServletRequest} object.
 	 * @return the {@code ServiceAuthenticationDetails} containing information about the
 	 * current request
@@ -25,8 +25,6 @@ import org.springframework.security.ldap.userdetails.LdapAuthoritiesPopulator;
 import org.springframework.security.ldap.userdetails.PersonContextMapper;

 /**
- * Test configurations for namespace-based LDAP {@code AuthenticationProvider} setup.
- *
 * @author Rob Winch
 *
 */
@@ -50,8 +50,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for anonymous authentication over RSocket.
- *
 * @author Andrey Litvitski
 */
@ContextConfiguration
@@ -50,8 +50,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for securing RSocket requests and responses.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -60,8 +60,6 @@ import static org.mockito.Mockito.times;
 import static org.mockito.Mockito.verify;

 /**
- * Integration tests for RSocket security observations.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -50,8 +50,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for RSocket security combined with WebFlux security.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -59,8 +59,6 @@ import static org.mockito.BDDMockito.given;
 import static org.mockito.Mockito.mock;

 /**
- * Integration tests for RSocket JWT authentication.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -53,8 +53,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for connecting to an {@link RSocketMessageHandler} secured server.
- *
 * @author Rob Winch
 * @author Luis Felipe Vega
 * @author Jesús Ascama Arias
@@ -55,8 +55,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for securing an {@link RSocketMessageHandler}.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -55,8 +55,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;

 /**
- * Integration tests for securing RSocket requests using simple authentication metadata.
- *
 * @author Rob Winch
 */
@ContextConfiguration
@@ -32,8 +32,6 @@ import org.springframework.test.util.ReflectionTestUtils;
 import static org.assertj.core.api.Assertions.assertThat;

 /**
- * Tests for the {@code ldap-server} XML namespace element.
- *
 * @author Luke Taylor
 * @author Rob Winch
 */
@@ -39,8 +39,6 @@ import static org.assertj.core.api.Assertions.assertThat;
 import static org.mockito.Mockito.mock;

 /**
- * Tests for the {@code ldap-user-service} bean definition parser.
- *
 * @author Luke Taylor
 * @author Rob Winch
 * @author Eddú Meléndez
@@ -31,7 +31,7 @@ public abstract class BeanIds {

 	/**
 	 * The "global" AuthenticationManager instance, registered by the
-	 * &lt;authentication-manager&gt; element.
+	 * &lt;authentication-manager&gt; element
 	 */
 	public static final String AUTHENTICATION_MANAGER = PREFIX + "authenticationManager";

@@ -25,9 +25,6 @@ import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.security.config.debug.SecurityDebugBeanFactoryPostProcessor;

 /**
- * Parses the {@code debug} element to register a
- * {@link SecurityDebugBeanFactoryPostProcessor}.
- *
 * @author Luke Taylor
 */
 public class DebugBeanDefinitionParser implements BeanDefinitionParser {
@@ -94,7 +94,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {
 	public BeanDefinition parse(Element element, ParserContext pc) {
 		if (!namespaceMatchesVersion(element)) {
 			pc.getReaderContext()
-				.fatal("You cannot use any XSD older than spring-security-7.1.xsd. Either change to spring-security.xsd or spring-security-7.1.xsd",
+				.fatal("You cannot use any XSD older than spring-security-7.2.xsd. Either change to spring-security.xsd or spring-security-7.2.xsd",
 						element);
 		}
 		String name = pc.getDelegate().getLocalName(element);
@@ -219,7 +219,7 @@ public final class SecurityNamespaceHandler implements NamespaceHandler {

 	private boolean matchesVersionInternal(Element element) {
 		String schemaLocation = element.getAttributeNS("http://www.w3.org/2001/XMLSchema-instance", "schemaLocation");
-		return schemaLocation.matches("(?m).*spring-security-7\\.1.*.xsd.*")
+		return schemaLocation.matches("(?m).*spring-security-7\\.2.*.xsd.*")
 				|| schemaLocation.matches("(?m).*spring-security.xsd.*")
 				|| !schemaLocation.matches("(?m).*spring-security.*");
 	}
@@ -187,7 +187,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * Gets the shared objects.
+	 * Gets the shared objects
 	 * @return the shared Objects
 	 */
 	public Map<Class<?>, Object> getSharedObjects() {
@@ -315,7 +315,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui

 	/**
 	 * Executes the build using the {@link SecurityConfigurer}'s that have been applied
-	 * using the following steps:.
+	 * using the following steps:
 	 *
 	 * <ul>
 	 * <li>Invokes {@link #beforeInit()} for any subclass to hook into</li>
@@ -406,7 +406,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	}

 	/**
-	 * The build state for the application.
+	 * The build state for the application
 	 *
 	 * @author Rob Winch
 	 * @since 3.2
@@ -414,7 +414,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 	private enum BuildState {

 		/**
-		 * This is the state before the {@link SecurityBuilder#build()} is invoked.
+		 * This is the state before the {@link SecurityBuilder#build()} is invoked
 		 */
 		UNBUILT(0),

@@ -455,7 +455,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		}

 		/**
-		 * Determines if the state is CONFIGURING or later.
+		 * Determines if the state is CONFIGURING or later
 		 * @return
 		 */
 		public boolean isConfigured() {
@@ -17,7 +17,7 @@
 package org.springframework.security.config.annotation;

 /**
- * Interface for building an Object.
+ * Interface for building an Object
 *
 * @param <O> The type of the Object being built
 * @author Rob Winch
@@ -115,7 +115,7 @@ public abstract class SecurityConfigurerAdapter<O, B extends SecurityBuilder<O>>
 		}

 		/**
-		 * Adds an {@link ObjectPostProcessor} to use.
+		 * Adds an {@link ObjectPostProcessor} to use
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} to add
 		 * @return true if the {@link ObjectPostProcessor} was added, else false
 		 */
@@ -22,7 +22,7 @@ import org.springframework.security.authentication.ProviderManager;
 import org.springframework.security.config.annotation.SecurityBuilder;

 /**
- * Interface for operating on a SecurityBuilder that creates a {@link ProviderManager}.
+ * Interface for operating on a SecurityBuilder that creates a {@link ProviderManager}
 *
 * @param <B> the type of the {@link SecurityBuilder}
 * @author Rob Winch
@@ -66,7 +66,7 @@ public class AuthenticationManagerBuilder
 	private AuthenticationEventPublisher eventPublisher;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 	 */
 	public AuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor) {
@@ -92,7 +92,7 @@ public class AuthenticationManagerBuilder
 	}

 	/**
-	 * Sets the {@link AuthenticationEventPublisher}.
+	 * Sets the {@link AuthenticationEventPublisher}
 	 * @param eventPublisher the {@link AuthenticationEventPublisher} to use
 	 * @return the {@link AuthenticationManagerBuilder} for further customizations
 	 */
@@ -103,7 +103,6 @@ public class AuthenticationManagerBuilder
 	}

 	/**
-	 * Sets whether the {@link AuthenticationManager} should clear the credentials.
 	 * @param eraseCredentials true if {@link AuthenticationManager} should clear the
 	 * credentials from the {@link Authentication} object after authenticating
 	 * @return the {@link AuthenticationManagerBuilder} for further customizations
@@ -54,7 +54,7 @@ import org.springframework.security.crypto.password.PasswordEncoder;
 import org.springframework.util.Assert;

 /**
- * Exports the authentication {@link Configuration}.
+ * Exports the authentication {@link Configuration}
 *
 * @author Rob Winch
 * @author Ngoc Nhan
@@ -265,7 +265,7 @@ public class AuthenticationConfiguration {
 		private PasswordEncoder defaultPasswordEncoder;

 		/**
-		 * Creates a new instance.
+		 * Creates a new instance
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 		 */
 		DefaultPasswordEncoderAuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor,
@@ -42,7 +42,6 @@ class InitializeAuthenticationProviderBeanManagerConfigurer extends GlobalAuthen
 	private final ApplicationContext context;

 	/**
-	 * Creates a new instance.
 	 * @param context the ApplicationContext to look up beans.
 	 */
 	InitializeAuthenticationProviderBeanManagerConfigurer(ApplicationContext context) {
@@ -49,7 +49,6 @@ class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationCon
 	private final ApplicationContext context;

 	/**
-	 * Creates a new instance using the given {@link ApplicationContext}.
 	 * @param context
 	 */
 	InitializeUserDetailsBeanManagerConfigurer(ApplicationContext context) {
@@ -113,8 +112,6 @@ class InitializeUserDetailsBeanManagerConfigurer extends GlobalAuthenticationCon
 		}

 		/**
-		 * Returns a bean of the requested class if there's just a single registered
-		 * component, null otherwise.
 		 * @return a bean of the requested class if there's just a single registered
 		 * component, null otherwise.
 		 */
@@ -136,7 +136,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 	/**
 	 * Gets the {@link LdapAuthoritiesPopulator} and defaults to
-	 * {@link DefaultLdapAuthoritiesPopulator}.
+	 * {@link DefaultLdapAuthoritiesPopulator}
 	 * @return the {@link LdapAuthoritiesPopulator}
 	 */
 	private LdapAuthoritiesPopulator getLdapAuthoritiesPopulator() {
@@ -185,7 +185,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates the {@link LdapAuthenticator} to use.
+	 * Creates the {@link LdapAuthenticator} to use
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return the {@link LdapAuthenticator} to use
 	 */
@@ -203,7 +203,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates {@link PasswordComparisonAuthenticator}.
+	 * Creates {@link PasswordComparisonAuthenticator}
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return
 	 */
@@ -218,7 +218,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Creates a {@link BindAuthenticator}.
+	 * Creates a {@link BindAuthenticator}
 	 * @param contextSource the {@link BaseLdapPathContextSource} to use
 	 * @return the {@link BindAuthenticator} to use
 	 */
@@ -395,7 +395,6 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Enables password-based comparison for authentication.
 	 * @return the {@link PasswordCompareConfigurer} for further customizations
 	 */
 	public PasswordCompareConfigurer passwordCompare() {
@@ -404,7 +403,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 	}

 	/**
-	 * Sets up Password based comparison.
+	 * Sets up Password based comparison
 	 *
 	 * @author Rob Winch
 	 */
@@ -435,7 +434,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 		/**
 		 * Allows obtaining a reference to the
-		 * {@link LdapAuthenticationProviderConfigurer} for further customizations.
+		 * {@link LdapAuthenticationProviderConfigurer} for further customizations
 		 * @return attribute in the directory which contains the user password
 		 */
 		public LdapAuthenticationProviderConfigurer<B> and() {
@@ -548,7 +547,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild

 		/**
 		 * Gets the {@link LdapAuthenticationProviderConfigurer} for further
-		 * customizations.
+		 * customizations
 		 * @return the {@link LdapAuthenticationProviderConfigurer} for further
 		 * customizations
 		 */
@@ -35,7 +35,7 @@ public class InMemoryUserDetailsManagerConfigurer<B extends ProviderManagerBuild
 		extends UserDetailsManagerConfigurer<B, InMemoryUserDetailsManagerConfigurer<B>> {

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 */
 	public InMemoryUserDetailsManagerConfigurer() {
 		super(new InMemoryUserDetailsManager(new ArrayList<>()));
@@ -140,7 +140,7 @@ public class JdbcUserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B
 	}

 	/**
-	 * Defines the {@link UserCache} to use.
+	 * Defines the {@link UserCache} to use
 	 * @param userCache the {@link UserCache} to use
 	 * @return the {@link JdbcUserDetailsManagerConfigurer} for further customizations
 	 */
@@ -112,7 +112,7 @@ public class UserDetailsManagerConfigurer<B extends ProviderManagerBuilder<B>, C
 		private final C builder;

 		/**
-		 * Creates a new instance.
+		 * Creates a new instance
 		 * @param builder the builder to return
 		 */
 		private UserDetailsBuilder(C builder) {
@@ -25,7 +25,7 @@ import org.springframework.security.core.userdetails.UserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
- * Allows configuring a {@link DaoAuthenticationProvider}.
+ * Allows configuring a {@link DaoAuthenticationProvider}
 *
 * @param <B> the type of the {@link SecurityBuilder}
 * @param <C> the type of {@link AbstractDaoAuthenticationConfigurer} this is
@@ -41,7 +41,7 @@ public abstract class AbstractDaoAuthenticationConfigurer<B extends ProviderMana
 	private final U userDetailsService;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param userDetailsService
 	 */
 	AbstractDaoAuthenticationConfigurer(U userDetailsService) {
@@ -88,7 +88,7 @@ public abstract class AbstractDaoAuthenticationConfigurer<B extends ProviderMana

 	/**
 	 * Gets the {@link UserDetailsService} that is used with the
-	 * {@link DaoAuthenticationProvider}.
+	 * {@link DaoAuthenticationProvider}
 	 * @return the {@link UserDetailsService} that is used with the
 	 * {@link DaoAuthenticationProvider}
 	 */
@@ -21,7 +21,7 @@ import org.springframework.security.config.annotation.authentication.ProviderMan
 import org.springframework.security.core.userdetails.UserDetailsService;

 /**
- * Allows configuring a {@link DaoAuthenticationProvider}.
+ * Allows configuring a {@link DaoAuthenticationProvider}
 *
 * @param <B> The type of {@link ProviderManagerBuilder} this is
 * @param <U> The type of {@link UserDetailsService} that is being used
@@ -32,7 +32,7 @@ public class DaoAuthenticationConfigurer<B extends ProviderManagerBuilder<B>, U
 		extends AbstractDaoAuthenticationConfigurer<B, DaoAuthenticationConfigurer<B, U>, U> {

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param userDetailsService
 	 */
 	public DaoAuthenticationConfigurer(U userDetailsService) {
@@ -34,7 +34,7 @@ public abstract class UserDetailsAwareConfigurer<B extends ProviderManagerBuilde
 		extends SecurityConfigurerAdapter<AuthenticationManager, B> {

 	/**
-	 * Gets the {@link UserDetailsService} or null if it is not available.
+	 * Gets the {@link UserDetailsService} or null if it is not available
 	 * @return the {@link UserDetailsService} or null if it is not available
 	 */
 	public abstract U getUserDetailsService();
@@ -35,7 +35,7 @@ public class UserDetailsServiceConfigurer<B extends ProviderManagerBuilder<B>, C
 		extends AbstractDaoAuthenticationConfigurer<B, C, U> {

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param userDetailsService the {@link UserDetailsService} that should be used
 	 */
 	public UserDetailsServiceConfigurer(U userDetailsService) {
@@ -28,8 +28,6 @@ import org.springframework.core.Ordered;
 import org.springframework.security.authorization.ReactiveAuthorizationManager;

 /**
- * Enables Spring Security reactive method security.
- *
 * @author Rob Winch
 * @since 5.0
 */
@@ -32,6 +32,7 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.ImportAware;
 import org.springframework.context.annotation.Role;
 import org.springframework.core.type.AnnotationMetadata;
+import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -127,6 +128,11 @@ final class PrePostMethodSecurityConfiguration implements ImportAware, Applicati
 		this.expressionHandler.setAuthorizationManagerFactory(authorizationManagerFactory);
 	}

+	@Autowired(required = false)
+	void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
+		this.expressionHandler.setPermissionEvaluator(permissionEvaluator);
+	}
+
 	@Autowired(required = false)
 	void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
 		this.preFilterMethodInterceptor.setTemplateDefaults(templateDefaults);
@@ -39,8 +39,6 @@ import org.springframework.security.access.prepost.PrePostAnnotationSecurityMeta
 import org.springframework.security.config.core.GrantedAuthorityDefaults;

 /**
- * Configures the infrastructure beans for reactive method security.
- *
 * @author Rob Winch
 * @author Tadaya Tsuyukubo
 * @since 5.0
@@ -30,8 +30,6 @@ import org.springframework.util.Assert;
 import org.springframework.util.ClassUtils;

 /**
- * Selects the imports to register for {@link EnableReactiveMethodSecurity}.
- *
 * @author Rob Winch
 * @author Evgeniy Cheban
 * @since 5.0
@@ -154,7 +154,7 @@ public class RSocketSecurity {
 	/**
 	 * Adds support for validating a username and password using <a href=
 	 * "https://github.com/rsocket/rsocket/blob/5920ed374d008abb712cb1fd7c9d91778b2f4a68/Extensions/Security/Simple.md">Simple
-	 * Authentication</a>.
+	 * Authentication</a>
 	 * @param simple a customizer
 	 * @return RSocketSecurity for additional configuration
 	 * @since 5.3
@@ -168,7 +168,7 @@ public class RSocketSecurity {
 	}

 	/**
-	 * Adds anonymous authentication.
+	 * Adds anonymous authentication
 	 * @param anonymous a customizer
 	 * @return this instance
 	 * @since 7.0
@@ -265,9 +265,6 @@ public class RSocketSecurity {
 	}

 	/**
-	 * Specifies the {@link ReactiveAuthenticationManager} to use for simple
-	 * authentication.
-	 *
 	 * @since 5.3
 	 */
 	public final class SimpleAuthenticationSpec {
@@ -289,7 +286,7 @@ public class RSocketSecurity {
 			return this.authenticationManager;
 		}

-		AuthenticationPayloadInterceptor build() {
+		protected AuthenticationPayloadInterceptor build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor result = new AuthenticationPayloadInterceptor(manager);
 			result.setAuthenticationConverter(new AuthenticationPayloadExchangeConverter());
@@ -307,7 +304,7 @@ public class RSocketSecurity {
 			this.parent = parent;
 		}

-		AnonymousPayloadInterceptor build() {
+		protected AnonymousPayloadInterceptor build() {
 			AnonymousPayloadInterceptor result = new AnonymousPayloadInterceptor("anonymousUser");
 			result.setOrder(PayloadInterceptorOrder.ANONYMOUS.getOrder());
 			return result;
@@ -338,7 +335,7 @@ public class RSocketSecurity {
 			return this.authenticationManager;
 		}

-		AuthenticationPayloadInterceptor build() {
+		protected AuthenticationPayloadInterceptor build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor result = new AuthenticationPayloadInterceptor(manager);
 			result.setOrder(PayloadInterceptorOrder.AUTHENTICATION.getOrder());
@@ -371,7 +368,7 @@ public class RSocketSecurity {
 			return RSocketSecurity.this.authenticationManager;
 		}

-		List<AuthenticationPayloadInterceptor> build() {
+		protected List<AuthenticationPayloadInterceptor> build() {
 			ReactiveAuthenticationManager manager = getAuthenticationManager();
 			AuthenticationPayloadInterceptor legacy = new AuthenticationPayloadInterceptor(manager);
 			legacy.setAuthenticationConverter(new BearerPayloadExchangeConverter());
@@ -396,7 +393,7 @@ public class RSocketSecurity {
 		/**
 		 * Matches if
 		 * {@link org.springframework.security.rsocket.api.PayloadExchangeType#isRequest()}
-		 * is true, else not a match.
+		 * is true, else not a match
 		 * @return the Access to set up the authorization rule.
 		 */
 		public Access anyRequest() {
@@ -404,7 +401,7 @@ public class RSocketSecurity {
 		}

 		/**
-		 * Always matches.
+		 * Always matches
 		 * @return the Access to set up the authorization rule.
 		 */
 		public Access anyExchange() {
@@ -30,8 +30,6 @@ import org.springframework.security.core.userdetails.ReactiveUserDetailsService;
 import org.springframework.security.crypto.password.PasswordEncoder;

 /**
- * {@link Configuration} for RSocket security infrastructure beans.
- *
 * @author Rob Winch
 * @since 5.2
 */
@@ -26,8 +26,6 @@ import org.springframework.security.rsocket.core.SecuritySocketAcceptorIntercept
 import org.springframework.security.rsocket.util.matcher.PayloadExchangeMatcher.MatchResult;

 /**
- * {@link Configuration} that exposes a {@link SecuritySocketAcceptorInterceptor} bean.
- *
 * @author Rob Winch
 * @since 5.2
 */
@@ -61,7 +61,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	}

 	/**
-	 * Gets the {@link ApplicationContext}.
+	 * Gets the {@link ApplicationContext}
 	 * @return the {@link ApplicationContext}
 	 */
 	protected final ApplicationContext getApplicationContext() {
@@ -111,7 +111,7 @@ public abstract class AbstractRequestMatcherRegistry<C> {

 	/**
 	 * Associates a list of {@link RequestMatcher} instances with the
-	 * {@link AbstractRequestMatcherRegistry}.
+	 * {@link AbstractRequestMatcherRegistry}
 	 * @param requestMatchers the {@link RequestMatcher} instances
 	 * @return the object that is chained after creating the {@link RequestMatcher}
 	 */
@@ -203,7 +203,6 @@ public abstract class AbstractRequestMatcherRegistry<C> {
 	 * If a specific {@link RequestMatcher} must be specified, use
 	 * {@link #requestMatchers(RequestMatcher...)} instead
 	 * </p>
-	 * .
 	 * @param method the {@link HttpMethod} to use or {@code null} for any
 	 * {@link HttpMethod}.
 	 * @return the object that is chained after creating the {@link RequestMatcher}.
@@ -53,9 +53,6 @@ import org.springframework.security.web.session.SessionManagementFilter;
 import org.springframework.web.filter.CorsFilter;

 /**
- * A builder for a {@link DefaultSecurityFilterChain} that allows configuring and ordering
- * the standard Spring Security {@link Filter} instances.
- *
 * @param <H>
 * @author Rob Winch
 */
@@ -92,14 +89,14 @@ public interface HttpSecurityBuilder<H extends HttpSecurityBuilder<H>>
 	<C> C getSharedObject(Class<C> sharedType);

 	/**
-	 * Allows adding an additional {@link AuthenticationProvider} to be used.
+	 * Allows adding an additional {@link AuthenticationProvider} to be used
 	 * @param authenticationProvider the {@link AuthenticationProvider} to be added
 	 * @return the {@link HttpSecurity} for further customizations
 	 */
 	H authenticationProvider(AuthenticationProvider authenticationProvider);

 	/**
-	 * Allows adding an additional {@link UserDetailsService} to be used.
+	 * Allows adding an additional {@link UserDetailsService} to be used
 	 * @param userDetailsService the {@link UserDetailsService} to be added
 	 * @return the {@link HttpSecurity} for further customizations
 	 */
@@ -159,7 +159,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	private AuthenticationManager authenticationManager;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} that should be used
 	 * @param authenticationBuilder the {@link AuthenticationManagerBuilder} to use for
 	 * additional updates
@@ -2092,7 +2092,7 @@ public final class HttpSecurity extends AbstractConfiguredSecurityBuilder<Defaul
 	}

 	/**
-	 * Allows mapping HTTP requests that this {@link HttpSecurity} will be used for.
+	 * Allows mapping HTTP requests that this {@link HttpSecurity} will be used for
 	 *
 	 * @author Rob Winch
 	 * @since 3.2
@@ -144,7 +144,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	private ServletContext servletContext;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param objectPostProcessor the {@link ObjectPostProcessor} to use
 	 * @see WebSecurityConfiguration
 	 */
@@ -279,7 +279,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,
 	}

 	/**
-	 * Executes the Runnable immediately after the build takes place.
+	 * Executes the Runnable immediately after the build takes place
 	 * @param postBuildAction
 	 * @return the {@link WebSecurity} for further customizations
 	 */
@@ -290,7 +290,7 @@ public final class WebSecurity extends AbstractConfiguredSecurityBuilder<Filter,

 	/**
 	 * Sets the handler to handle
-	 * {@link org.springframework.security.web.firewall.RequestRejectedException}.
+	 * {@link org.springframework.security.web.firewall.RequestRejectedException}
 	 * @param requestRejectedHandler
 	 * @return the {@link WebSecurity} for further customizations
 	 * @since 5.7
@@ -32,7 +32,7 @@ import org.springframework.security.web.util.matcher.AnyRequestMatcher;
 import org.springframework.util.ClassUtils;

 /**
- * A filter chain validator for filter chains built by {@link WebSecurity}.
+ * A filter chain validator for filter chains built by {@link WebSecurity}
 *
 * @author Josh Cummings
 * @author Max Batischev
@@ -30,7 +30,7 @@ import org.springframework.security.web.SecurityFilterChain;
 /**
 * Add this annotation to an {@code @Configuration} class to have the Spring Security
 * configuration defined in any {@link WebSecurityConfigurer} or more likely by exposing a
- * {@link SecurityFilterChain} bean:.
+ * {@link SecurityFilterChain} bean:
 *
 * <pre class="code">
 * &#064;Configuration
@@ -256,7 +256,7 @@ class HttpSecurityConfiguration {
 		private PasswordEncoder defaultPasswordEncoder;

 		/**
-		 * Creates a new instance.
+		 * Creates a new instance
 		 * @param objectPostProcessor the {@link ObjectPostProcessor} instance to use.
 		 */
 		DefaultPasswordEncoderAuthenticationManagerBuilder(ObjectPostProcessor<Object> objectPostProcessor,
@@ -101,8 +101,6 @@ final class OAuth2ClientConfiguration {
 	}

 	/**
-	 * Configures the infrastructure beans for the {@code OAuth2AuthorizedClientManager}.
-	 *
 	 * @author Joe Grandja
 	 * @since 6.2.0
 	 */
@@ -25,7 +25,7 @@ import org.springframework.util.ClassUtils;
 import org.springframework.util.StringUtils;

 /**
- * Used by {@link EnableWebSecurity} to conditionally import:.
+ * Used by {@link EnableWebSecurity} to conditionally import:
 *
 * <ul>
 * <li>{@link OAuth2ClientConfiguration} when the {@code spring-security-oauth2-client}
@@ -200,7 +200,7 @@ class SecurityReactorContextConfiguration {
 	}

 	/**
-	 * A map that computes each value when {@link #get} is invoked.
+	 * A map that computes each value when {@link #get} is invoked
 	 */
 	static class LoadingMap<K, V> implements Map<K, V> {

@@ -118,14 +118,14 @@ class WebMvcSecurityConfiguration implements WebMvcConfigurer, ApplicationContex
 	static class CompositeFilterChainProxy extends FilterChainProxy {

 		/**
-		 * Used for {@link #doFilter(ServletRequest, ServletResponse, FilterChain)}.
+		 * Used for {@link #doFilter(ServletRequest, ServletResponse, FilterChain)}
 		 */
 		private final Filter doFilterDelegate;

 		private final FilterChainProxy springSecurityFilterChain;

 		/**
-		 * Creates a new instance.
+		 * Creates a new instance
 		 * @param filters the Filters to delegate to. One of which must be
 		 * FilterChainProxy.
 		 */
@@ -197,7 +197,7 @@ class WebMvcSecurityConfiguration implements WebMvcConfigurer, ApplicationContex
 		}

 		/**
-		 * Creates the Filter to delegate to for doFilter.
+		 * Creates the Filter to delegate to for doFilter
 		 * @param filters the Filters to delegate to.
 		 * @return the Filter for doFilter
 		 */
@@ -208,7 +208,7 @@ class WebMvcSecurityConfiguration implements WebMvcConfigurer, ApplicationContex
 		}

 		/**
-		 * Find the FilterChainProxy in a List of Filter.
+		 * Find the FilterChainProxy in a List of Filter
 		 * @param filters
 		 * @return non-null FilterChainProxy
 		 * @throws IllegalStateException if the FilterChainProxy cannot be found
@@ -106,7 +106,7 @@ public class WebSecurityConfiguration implements ImportAware {
 	}

 	/**
-	 * Creates the Spring Security Filter Chain.
+	 * Creates the Spring Security Filter Chain
 	 * @return the {@link Filter} that represents the security filter chain
 	 * @throws Exception
 	 */
@@ -133,7 +133,7 @@ public class WebSecurityConfiguration implements ImportAware {

 	/**
 	 * Creates the {@link WebInvocationPrivilegeEvaluator} that is necessary to evaluate
-	 * privileges for a given web URI.
+	 * privileges for a given web URI
 	 * @return the {@link WebInvocationPrivilegeEvaluator}
 	 */
 	@Bean
@@ -290,14 +290,14 @@ public class WebSecurityConfiguration implements ImportAware {
 	static class CompositeFilterChainProxy extends FilterChainProxy {

 		/**
-		 * Used for {@link #doFilter(ServletRequest, ServletResponse, FilterChain)}.
+		 * Used for {@link #doFilter(ServletRequest, ServletResponse, FilterChain)}
 		 */
 		private final Filter doFilterDelegate;

 		private final FilterChainProxy springSecurityFilterChain;

 		/**
-		 * Creates a new instance.
+		 * Creates a new instance
 		 * @param filters the Filters to delegate to. One of which must be
 		 * FilterChainProxy.
 		 */
@@ -369,7 +369,7 @@ public class WebSecurityConfiguration implements ImportAware {
 		}

 		/**
-		 * Creates the Filter to delegate to for doFilter.
+		 * Creates the Filter to delegate to for doFilter
 		 * @param filters the Filters to delegate to.
 		 * @return the Filter for doFilter
 		 */
@@ -380,7 +380,7 @@ public class WebSecurityConfiguration implements ImportAware {
 		}

 		/**
-		 * Find the FilterChainProxy in a List of Filter.
+		 * Find the FilterChainProxy in a List of Filter
 		 * @param filters
 		 * @return non-null FilterChainProxy
 		 * @throws IllegalStateException if the FilterChainProxy cannot be found
@@ -85,14 +85,14 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	private String failureUrl;

 	/**
-	 * Creates a new instance with minimal defaults.
+	 * Creates a new instance with minimal defaults
 	 */
 	protected AbstractAuthenticationFilterConfigurer() {
 		setLoginPage("/login");
 	}

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @param authenticationFilter the {@link AbstractAuthenticationProcessingFilter} to
 	 * use
 	 * @param defaultLoginProcessingUrl the default URL to use for
@@ -152,7 +152,7 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	}

 	/**
-	 * Create the {@link RequestMatcher} given a loginProcessingUrl.
+	 * Create the {@link RequestMatcher} given a loginProcessingUrl
 	 * @param loginProcessingUrl creates the {@link RequestMatcher} based upon the
 	 * loginProcessingUrl
 	 * @return the {@link RequestMatcher} to use based upon the loginProcessingUrl
@@ -184,7 +184,7 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	}

 	/**
-	 * Equivalent of invoking permitAll(true).
+	 * Equivalent of invoking permitAll(true)
 	 * @return the {@link FormLoginConfigurer} for additional customization
 	 */
 	public final T permitAll() {
@@ -324,7 +324,6 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	}

 	/**
-	 * Returns true if a custom login page has been specified.
 	 * @return true if a custom login page has been specified, else false
 	 */
 	public final boolean isCustomLoginPage() {
@@ -332,7 +331,7 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	}

 	/**
-	 * Gets the Authentication Filter.
+	 * Gets the Authentication Filter
 	 * @return the Authentication Filter
 	 */
 	protected final F getAuthenticationFilter() {
@@ -340,7 +339,7 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	}

 	/**
-	 * Sets the Authentication Filter.
+	 * Sets the Authentication Filter
 	 * @param authFilter the Authentication Filter
 	 */
 	protected final void setAuthenticationFilter(F authFilter) {
@@ -348,7 +347,7 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	}

 	/**
-	 * Gets the login page.
+	 * Gets the login page
 	 * @return the login page
 	 */
 	protected final String getLoginPage() {
@@ -356,7 +355,7 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	}

 	/**
-	 * Gets the Authentication Entry Point.
+	 * Gets the Authentication Entry Point
 	 * @return the Authentication Entry Point
 	 */
 	protected final AuthenticationEntryPoint getAuthenticationEntryPoint() {
@@ -373,7 +372,7 @@ public abstract class AbstractAuthenticationFilterConfigurer<B extends HttpSecur
 	}

 	/**
-	 * Gets the URL to send users to if authentication fails.
+	 * Gets the URL to send users to if authentication fails
 	 * @return the URL to send users if authentication fails (e.g. "/login?error").
 	 */
 	protected final String getFailureUrl() {
@@ -105,7 +105,7 @@ public abstract class AbstractConfigAttributeRequestMatcherRegistry<C> extends A

 	/**
 	 * Creates the mapping of {@link RequestMatcher} to {@link Collection} of
-	 * {@link ConfigAttribute} instances.
+	 * {@link ConfigAttribute} instances
 	 * @return the mapping of {@link RequestMatcher} to {@link Collection} of
 	 * {@link ConfigAttribute} instances. Cannot be null.
 	 */
@@ -123,7 +123,7 @@ public abstract class AbstractConfigAttributeRequestMatcherRegistry<C> extends A

 	/**
 	 * A mapping of {@link RequestMatcher} to {@link Collection} of
-	 * {@link ConfigAttribute} instances.
+	 * {@link ConfigAttribute} instances
 	 */
 	static final class UrlMapping {

@@ -58,7 +58,7 @@ public final class AnonymousConfigurer<H extends HttpSecurityBuilder<H>>
 	private String computedKey;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @see HttpSecurity#anonymous(Customizer)
 	 */
 	public AnonymousConfigurer() {
@@ -78,7 +78,7 @@ public final class AnonymousConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Sets the principal for {@link Authentication} objects of anonymous users.
+	 * Sets the principal for {@link Authentication} objects of anonymous users
 	 * @param principal used for the {@link Authentication} object of anonymous users
 	 * @return the {@link AnonymousConfigurer} for further customization of anonymous
 	 * authentication
@@ -90,7 +90,7 @@ public final class AnonymousConfigurer<H extends HttpSecurityBuilder<H>>

 	/**
 	 * Sets the {@link org.springframework.security.core.Authentication#getAuthorities()}
-	 * for anonymous users.
+	 * for anonymous users
 	 * @param authorities Sets the
 	 * {@link org.springframework.security.core.Authentication#getAuthorities()} for
 	 * anonymous users
@@ -104,7 +104,7 @@ public final class AnonymousConfigurer<H extends HttpSecurityBuilder<H>>

 	/**
 	 * Sets the {@link org.springframework.security.core.Authentication#getAuthorities()}
-	 * for anonymous users.
+	 * for anonymous users
 	 * @param authorities Sets the
 	 * {@link org.springframework.security.core.Authentication#getAuthorities()} for
 	 * anonymous users (i.e. "ROLE_ANONYMOUS")
@@ -414,7 +414,7 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder

 		/**
 		 * An object that allows configuring {@link RequestMatcher}s with URI path
-		 * variables.
+		 * variables
 		 *
 		 * @author Taehong Kim
 		 * @since 6.3
@@ -433,7 +433,7 @@ public final class AuthorizeHttpRequestsConfigurer<H extends HttpSecurityBuilder
 			 * <p>
 			 * For example, <pre>
 			 * requestMatchers("/user/{username}").hasVariable("username").equalTo(Authentication::getName));
-			 * </pre>.
+			 * </pre>
 			 * @param function a function to get value from {@link Authentication}.
 			 * @return the {@link AuthorizationManagerRequestMatcherRegistry} for further
 			 * customization.
@@ -92,7 +92,7 @@ public final class ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>
 	private final ChannelRequestMatcherRegistry REGISTRY;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @see HttpSecurity#requiresChannel(Customizer)
 	 */
 	public ChannelSecurityConfigurer(ApplicationContext context) {
@@ -147,9 +147,6 @@ public final class ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Allows registering {@link RequestMatcher}s that should be mapped to a channel
-	 * requirement.
-	 *
 	 * @deprecated no replacement planned
 	 */
 	@Deprecated
@@ -177,7 +174,7 @@ public final class ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>

 		/**
 		 * Sets the {@link ChannelProcessor} instances to use in
-		 * {@link ChannelDecisionManagerImpl}.
+		 * {@link ChannelDecisionManagerImpl}
 		 * @param channelProcessors
 		 * @return the {@link ChannelSecurityConfigurer} for further customizations
 		 */
@@ -188,7 +185,7 @@ public final class ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>

 		/**
 		 * Sets the {@link RedirectStrategy} instances to use in
-		 * {@link RetryWithHttpEntryPoint} and {@link RetryWithHttpsEntryPoint}.
+		 * {@link RetryWithHttpEntryPoint} and {@link RetryWithHttpsEntryPoint}
 		 * @param redirectStrategy
 		 * @return the {@link ChannelSecurityConfigurer} for further customizations
 		 */
@@ -200,9 +197,6 @@ public final class ChannelSecurityConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Allows registering a channel requirement for the previously specified
-	 * {@link RequestMatcher}s.
-	 *
 	 * @deprecated no replacement planned
 	 */
 	@Deprecated
@@ -49,7 +49,7 @@ public class CorsConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractHt
 	private PreFlightRequestHandler preFlightRequestHandler;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 *
 	 * @see HttpSecurity#cors(Customizer)
 	 */
@@ -148,7 +148,7 @@ public class CorsConfigurer<H extends HttpSecurityBuilder<H>> extends AbstractHt

 		/**
 		 * This needs to be isolated into a separate class as Spring MVC is an optional
-		 * dependency and will potentially cause ClassLoading issues.
+		 * dependency and will potentially cause ClassLoading issues
 		 * @param context
 		 * @return
 		 */
@@ -103,7 +103,7 @@ public final class CsrfConfigurer<H extends HttpSecurityBuilder<H>>
 	private final ApplicationContext context;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @see HttpSecurity#csrf(Customizer)
 	 */
 	public CsrfConfigurer(ApplicationContext context) {
@@ -83,7 +83,7 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>
 	private DelegatingMissingAuthorityAccessDeniedHandler.@Nullable Builder missingAuthoritiesHandlerBuilder;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @see HttpSecurity#exceptionHandling(Customizer)
 	 */
 	public ExceptionHandlingConfigurer() {
@@ -91,7 +91,7 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>

 	/**
 	 * Shortcut to specify the {@link AccessDeniedHandler} to be used is a specific error
-	 * page.
+	 * page
 	 * @param accessDeniedUrl the URL to the access denied page (i.e. /errors/401)
 	 * @return the {@link ExceptionHandlingConfigurer} for further customization
 	 * @see AccessDeniedHandlerImpl
@@ -104,7 +104,7 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Specifies the {@link AccessDeniedHandler} to be used.
+	 * Specifies the {@link AccessDeniedHandler} to be used
 	 * @param accessDeniedHandler the {@link AccessDeniedHandler} to be used
 	 * @return the {@link ExceptionHandlingConfigurer} for further customization
 	 */
@@ -213,7 +213,7 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Gets any explicitly configured {@link AuthenticationEntryPoint}.
+	 * Gets any explicitly configured {@link AuthenticationEntryPoint}
 	 * @return
 	 */
 	AuthenticationEntryPoint getAuthenticationEntryPoint() {
@@ -242,7 +242,7 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>

 	/**
 	 * Gets the {@link AccessDeniedHandler} according to the rules specified by
-	 * {@link #accessDeniedHandler(AccessDeniedHandler)}.
+	 * {@link #accessDeniedHandler(AccessDeniedHandler)}
 	 * @param http the {@link HttpSecurity} used to look up shared
 	 * {@link AccessDeniedHandler}
 	 * @return the {@link AccessDeniedHandler} to use
@@ -257,7 +257,7 @@ public final class ExceptionHandlingConfigurer<H extends HttpSecurityBuilder<H>>

 	/**
 	 * Gets the {@link AuthenticationEntryPoint} according to the rules specified by
-	 * {@link #authenticationEntryPoint(AuthenticationEntryPoint)}.
+	 * {@link #authenticationEntryPoint(AuthenticationEntryPoint)}
 	 * @param http the {@link HttpSecurity} used to look up shared
 	 * {@link AuthenticationEntryPoint}
 	 * @return the {@link AuthenticationEntryPoint} to use
@@ -74,7 +74,7 @@ public final class FormLoginConfigurer<H extends HttpSecurityBuilder<H>> extends
 		AbstractAuthenticationFilterConfigurer<H, FormLoginConfigurer<H>, UsernamePasswordAuthenticationFilter> {

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @see HttpSecurity#formLogin(Customizer)
 	 */
 	public FormLoginConfigurer() {
@@ -209,7 +209,7 @@ public final class FormLoginConfigurer<H extends HttpSecurityBuilder<H>> extends
 	}

 	/**
-	 * Forward Authentication Failure Handler.
+	 * Forward Authentication Failure Handler
 	 * @param forwardUrl the target URL in case of failure
 	 * @return the {@link FormLoginConfigurer} for additional customization
 	 */
@@ -219,7 +219,7 @@ public final class FormLoginConfigurer<H extends HttpSecurityBuilder<H>> extends
 	}

 	/**
-	 * Forward Authentication Success Handler.
+	 * Forward Authentication Success Handler
 	 * @param forwardUrl the target URL in case of success
 	 * @return the {@link FormLoginConfigurer} for additional customization
 	 */
@@ -109,7 +109,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 	private final CrossOriginResourcePolicyConfig crossOriginResourcePolicy = new CrossOriginResourcePolicyConfig();

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 *
 	 * @see HttpSecurity#headers(Customizer)
 	 */
@@ -117,7 +117,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Adds a {@link HeaderWriter} instance.
+	 * Adds a {@link HeaderWriter} instance
 	 * @param headerWriter the {@link HeaderWriter} instance to add
 	 * @return the {@link HeadersConfigurer} for additional customizations
 	 */
@@ -130,7 +130,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 	/**
 	 * Configures the {@link XContentTypeOptionsHeaderWriter} which inserts the
 	 * <a href= "https://msdn.microsoft.com/en-us/library/ie/gg622941(v=vs.85).aspx"
-	 * >X-Content-Type-Options</a>:.
+	 * >X-Content-Type-Options</a>:
 	 *
 	 * <pre>
 	 * X-Content-Type-Options: nosniff
@@ -145,7 +145,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * <strong>Note this is not comprehensive XSS protection!</strong>.
+	 * <strong>Note this is not comprehensive XSS protection!</strong>
 	 *
 	 * <p>
 	 * Allows customizing the {@link XXssProtectionHeaderWriter} which adds the <a href=
@@ -276,7 +276,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Creates the {@link HeaderWriter}.
+	 * Creates the {@link HeaderWriter}
 	 * @return the {@link HeaderWriter}
 	 */
 	private HeaderWriterFilter createHeaderWriterFilter() {
@@ -504,7 +504,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 		}

 		/**
-		 * Ensures that Content Type Options is enabled.
+		 * Ensures that Content Type Options is enabled
 		 * @return the {@link ContentTypeOptionsConfig} for additional customization
 		 */
 		private ContentTypeOptionsConfig enable() {
@@ -559,7 +559,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 		}

 		/**
-		 * Disables X-XSS-Protection header (does not include it).
+		 * Disables X-XSS-Protection header (does not include it)
 		 * @return the {@link HeadersConfigurer} for additional configuration
 		 */
 		public HeadersConfigurer<H> disable() {
@@ -589,7 +589,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 		}

 		/**
-		 * Disables Cache Control.
+		 * Disables Cache Control
 		 * @return the {@link HeadersConfigurer} for additional configuration
 		 */
 		public HeadersConfigurer<H> disable() {
@@ -686,7 +686,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 		}

 		/**
-		 * Disables Strict Transport Security.
+		 * Disables Strict Transport Security
 		 * @return the {@link HeadersConfigurer} for additional configuration
 		 */
 		public HeadersConfigurer<H> disable() {
@@ -695,7 +695,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 		}

 		/**
-		 * Ensures that Strict-Transport-Security is enabled if it is not already.
+		 * Ensures that Strict-Transport-Security is enabled if it is not already
 		 * @return the {@link HstsConfig} for additional customization
 		 */
 		private HstsConfig enable() {
@@ -761,8 +761,6 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 	}

 	/**
-	 * Configures the HTTP Public Key Pinning (HPKP) header.
-	 *
 	 * @deprecated see <a href=
 	 * "https://owasp.org/www-community/controls/Certificate_and_Public_Key_Pinning">Certificate
 	 * and Public Key Pinning</a> for more context
@@ -923,7 +921,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>

 		/**
 		 * Ensures that Public-Key-Pins or Public-Key-Pins-Report-Only is enabled if it is
-		 * not already.
+		 * not already
 		 * @return the {@link HstsConfig} for additional customization
 		 */
 		private HpkpConfig enable() {
@@ -1031,7 +1029,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 		}

 		/**
-		 * Sets the policy to be used in the {@code Cross-Origin-Opener-Policy} header.
+		 * Sets the policy to be used in the {@code Cross-Origin-Opener-Policy} header
 		 * @param openerPolicy a {@code Cross-Origin-Opener-Policy}
 		 * @return the {@link CrossOriginOpenerPolicyConfig} for additional configuration
 		 * @throws IllegalArgumentException if openerPolicy is null
@@ -1052,7 +1050,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 		}

 		/**
-		 * Sets the policy to be used in the {@code Cross-Origin-Embedder-Policy} header.
+		 * Sets the policy to be used in the {@code Cross-Origin-Embedder-Policy} header
 		 * @param embedderPolicy a {@code Cross-Origin-Embedder-Policy}
 		 * @return the {@link CrossOriginEmbedderPolicyConfig} for additional
 		 * configuration
@@ -1074,7 +1072,7 @@ public class HeadersConfigurer<H extends HttpSecurityBuilder<H>>
 		}

 		/**
-		 * Sets the policy to be used in the {@code Cross-Origin-Resource-Policy} header.
+		 * Sets the policy to be used in the {@code Cross-Origin-Resource-Policy} header
 		 * @param resourcePolicy a {@code Cross-Origin-Resource-Policy}
 		 * @return the {@link CrossOriginResourcePolicyConfig} for additional
 		 * configuration
@@ -98,7 +98,7 @@ public final class HttpBasicConfigurer<B extends HttpSecurityBuilder<B>>
 	private SecurityContextRepository securityContextRepository;

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @see HttpSecurity#httpBasic(Customizer)
 	 */
 	public HttpBasicConfigurer() {
@@ -78,7 +78,7 @@ public final class JeeConfigurer<H extends HttpSecurityBuilder<H>> extends Abstr
 	private Set<String> mappableRoles = new HashSet<>();

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @see HttpSecurity#jee(Customizer)
 	 */
 	public JeeConfigurer() {
@@ -185,7 +185,7 @@ public final class JeeConfigurer<H extends HttpSecurityBuilder<H>> extends Abstr
 	 * Populates a {@link PreAuthenticatedAuthenticationProvider} into
 	 * {@link HttpSecurity#authenticationProvider(org.springframework.security.authentication.AuthenticationProvider)}
 	 * and a {@link Http403ForbiddenEntryPoint} into
-	 * {@link HttpSecurityBuilder#setSharedObject(Class, Object)}.
+	 * {@link HttpSecurityBuilder#setSharedObject(Class, Object)}
 	 *
 	 * @see SecurityConfigurer#init(org.springframework.security.config.annotation.SecurityBuilder)
 	 */
@@ -92,7 +92,7 @@ public final class LogoutConfigurer<H extends HttpSecurityBuilder<H>>
 	private LinkedHashMap<RequestMatcher, LogoutSuccessHandler> defaultLogoutSuccessHandlerMappings = new LinkedHashMap<>();

 	/**
-	 * Creates a new instance.
+	 * Creates a new instance
 	 * @see HttpSecurity#logout(Customizer)
 	 */
 	public LogoutConfigurer() {
@@ -24,7 +24,7 @@ import org.springframework.security.web.util.matcher.RequestMatcher;
 import org.springframework.util.Assert;

 /**
- * Configures non-null URL's to grant access to every URL.
+ * Configures non-null URL's to grant access to every URL
 *
 * @author Rob Winch
 * @since 3.2
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Josh Cummings	c9b653b563	Fix Formatting and Style Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-09-04 09:10:59 -07:00
Yohei Kishimoto	7ddce27828	throw original exception to keep compatibility with common RestTemplate Signed-off-by: Yohei Kishimoto <morokosi@users.noreply.github.com>	2026-09-04 09:10:59 -07:00
Josh Cummings	08517085b2	Merge branch '7.1.x'	2026-09-04 09:02:35 -06:00
Josh Cummings	1dcb0b4927	Merge branch '7.1.x'	2026-09-04 09:01:11 -06:00
Josh Cummings	47373888ac	Merge branch '7.1.x'	2026-09-04 08:54:23 -06:00
Josh Cummings	d2d9d14b8f	Merge branch '7.1.x'	2026-09-04 08:32:02 -06:00
Manuel Siggen	29f8dd53cd	Pick Up PermissionEvaluator Bean Closes gh-19084 Signed-off-by: Manuel Siggen <manuel@siggen.ch>	2026-09-03 16:57:46 -07:00
Josh Cummings	7526dfa694	Merge branch '7.1.x'	2026-09-03 15:42:38 -06:00
Josh Cummings	d09463b865	Merge branch '7.1.x' Closes gh-19649	2026-09-03 15:28:33 -06:00
Josh Cummings	c7be397a16	Merge branch '7.1.x' # Conflicts: # docs/modules/ROOT/pages/reactive/authentication/onetimetoken.adoc # docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc	2026-09-03 15:14:01 -06:00
Josh Cummings	2e52e1063a	Merge branch '7.1.x' Closes gh-19646	2026-09-03 12:27:03 -06:00
avsan	b26d968c1c	Simplify ProviderManager null provider check Use Assert.noNullElements to validate configured AuthenticationProviders without relying on CollectionUtils.contains. Preserve the existing null-provider validation behavior. Closes gh-19510 Signed-off-by: avsan <abhishekrajabca@gmail.com>	2026-09-03 11:10:09 -07:00
Josh Cummings	3070c96594	Add authenticationSuccessHandler to Reactive Resource Server Kotlin DSL Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-09-01 18:14:07 -07:00
Josh Cummings	6eb7ef6e6d	Update What's New Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-09-01 18:14:07 -07:00
Josh Cummings	988ba6b33c	Align Formatting Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-09-01 18:14:07 -07:00
Iain Henderson	d1fb6141c1	Add authenticationSuccessHandler to Reactive Resource Server DSL Signed-off-by: Iain Henderson <Iain.henderson@mac.com>	2026-09-01 18:14:07 -07:00
Josh Cummings	43f5ae5b21	Remove Auto-merge for .x Branches Closes gh-19632 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-31 10:43:16 -06:00
Josh Cummings	b2a6bbf314	Merge branch '7.1.x'	2026-08-31 10:42:04 -06:00
Joe Grandja	36aa2ad744	Merge branch '7.1.x'	2026-08-31 12:02:21 -04:00
Josh Cummings	ed4e0e2ea8	Merge branch '7.1.x'	2026-08-31 09:55:00 -06:00
Josh Cummings	61feae94a0	Merge branch '7.1.x'	2026-08-26 10:17:45 -06:00
Josh Cummings	d449950b36	Merge branch '7.1.x' Closes gh-19573	2026-08-20 16:58:15 -06:00
Josh Cummings	19afc9121e	Merge branch '7.1.x' Closes gh-19568 # Conflicts: # gradle/libs.versions.toml	2026-08-20 12:29:12 -06:00
Josh Cummings	1fe59232f0	Update to Spring Data 2026.1.0-M1 Closes gh-19531 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:10 -06:00
Josh Cummings	8f13ab216f	Update to Micrometer 1.18.0-M1 Closes gh-19530 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:09 -06:00
Josh Cummings	8beb08974b	Update to Reactor 2026.0.0-M1 Closes gh-19529 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:09 -06:00
Josh Cummings	49c89546c6	Update to Spring Framework 7.1.0-M1 Closes gh-19528 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:09 -06:00
Josh Cummings	5a74026036	Use jspecify Nullable in DPoPProofReplayValidator org.springframework.lang.Nullable is banned by the bannedNullabilityImports checkstyle rule on this line; the embargoed commit that introduced this file predates that rule's adoption here. Switch to org.jspecify.annotations.Nullable to match the rest of the codebase (already used correctly elsewhere in this same file). Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:09 -06:00
Josh Cummings	c9220ca39e	Align Null Behavior Previously, ExternalInetAddressMatcher treated a null InetAddress as external by negating InternalInetAddressMatcher's result. This commit makes ExternalInetAddressMatcher return false for a null address, so that neither the internal nor the external matcher classifies an unknown address as a match. Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:09 -06:00
Josh Cummings	b6b9d743a0	Deprecate AesBytesEncryptor This commit separates AesBytesEncryptor into two separate implememtations, allowing for a migration away from default arrangements that used a null IV Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:08 -06:00
Josh Cummings	8ded9dac6a	Improve Equivalence Tests This commit adds equals and hashCode implementations as well as a readResolve implementation to ensure that deserialization mechanisms can correctly assess the equality of a constnat and a corresponding deserialized instance. For defense-in-depth reasons, this commit also favors .equals over == for these constants. Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:08 -06:00
Joe Grandja	1b84c74776	Bind UnboundIdContainer to loopback address	2026-08-20 10:38:08 -06:00
Joe Grandja	83dfc0790e	Apply html encoding in DefaultConsentPage	2026-08-20 10:38:08 -06:00
Joe Grandja	b55f66695e	Provide ability to configure DPoP proof replay	2026-08-20 10:38:08 -06:00
Josh Cummings	177e482783	Use Constant-Time Comparison This commit updates password encoders to use a constant-time comparison method to defend against timing attacks Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:07 -06:00
Josh Cummings	04d95818e3	Use Utf8#isEqual Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:07 -06:00
Josh Cummings	627a412748	Use Constant-Time Equals This commit updates the filter to use constant-time equals for sensitive material Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:07 -06:00
Josh Cummings	addebb61ed	Use Constant-Time Equals This commit updates the filter to use constant-time equals for sensitive material Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:07 -06:00
Josh Cummings	75d985fb13	Add Utf8#isEqual This commit adds a constant-time equals method, useful for comparing password hashes or other sensitive material Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:07 -06:00
Josh Cummings	342b24d43e	Use MessageDigest#isEqual This commit favors constant-time comparison to mitigate timing attacks Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:07 -06:00
Josh Cummings	2f97d8dac2	Add Tests for User and Device Code Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-20 10:38:06 -06:00
dependabot[bot]	3881de5d6c	Bump com.fasterxml.jackson:jackson-bom from 2.22.1 to 2.22.2 Bumps [com.fasterxml.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 2.22.1 to 2.22.2. - [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-2.22.1...jackson-bom-2.22.2) --- updated-dependencies: - dependency-name: com.fasterxml.jackson:jackson-bom dependency-version: 2.22.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-20 03:17:09 +00:00
Josh Cummings	1fa37a9479	Merge branch '7.1.x'	2026-08-19 16:55:49 -06:00
Josh Cummings	d7ea83017a	Make MockSecurityContextHolderStrategy Thread-safe Closes gh-19547 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-19 16:54:12 -06:00
Joe Grandja	6401fde9f2	Merge branch '7.1.x'	2026-08-18 12:17:53 -04:00
dependabot[bot]	b622028f84	Bump tools.jackson:jackson-bom from 3.2.1 to 3.2.2 Bumps [tools.jackson:jackson-bom](https://github.com/FasterXML/jackson-bom) from 3.2.1 to 3.2.2. - [Commits](https://github.com/FasterXML/jackson-bom/compare/jackson-bom-3.2.1...jackson-bom-3.2.2) --- updated-dependencies: - dependency-name: tools.jackson:jackson-bom dependency-version: 3.2.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-18 03:16:54 +00:00
dependabot[bot]	8b92e71cb2	Bump ch.qos.logback:logback-classic from 1.6.2 to 1.6.3 Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.6.2 to 1.6.3. - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.6.2...v_1.6.3) --- updated-dependencies: - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.6.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-18 03:16:27 +00:00
dependabot[bot]	6ed154527e	Bump ch.qos.logback:logback-classic from 1.6.1 to 1.6.2 Bumps [ch.qos.logback:logback-classic](https://github.com/qos-ch/logback) from 1.6.1 to 1.6.2. - [Release notes](https://github.com/qos-ch/logback/releases) - [Commits](https://github.com/qos-ch/logback/compare/v_1.6.1...v_1.6.2) --- updated-dependencies: - dependency-name: ch.qos.logback:logback-classic dependency-version: 1.6.2 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-17 03:18:43 +00:00
Josh Cummings	82241b6cb8	Merge branch '7.1.x' Closes gh-19549	2026-08-13 15:59:03 -06:00
Josh Cummings	6eb16dc35e	Merge branch '7.1.x' Closes gh-19546	2026-08-13 15:20:47 -06:00
Josh Cummings	1ad93f45f8	Add Test Coverage for Implicit CORS Bean Detection Verify that <cors> detects a PreFlightRequestHandler bean and uses a PreFlightRequestFilter when no explicit ref or configuration-source-ref is given and no mvcHandlerMappingIntrospector bean is present. See gh-19542 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 13:25:09 -06:00
Josh Cummings	8c9a8e3f6c	Suppress Removal Warnings on RestOperations Usage Spring Framework 7.1 deprecates RestTemplate and related types for removal. Suppress the resulting warnings at existing internal usage sites until they are migrated to RestClient per gh-19027. Closes gh-19544 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 11:59:50 -06:00
Josh Cummings	a8f54db7e4	Disable CORS Tests Relying on HandlerMappingIntrospector Spring Framework 7.1 removes HandlerMappingIntrospector-derived implicit CORS handling for plain requests; these tests assert the old behavior. Closes gh-19543 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 11:54:26 -06:00
Josh Cummings	24bfdc1dee	Support Implicit CORS Bean Detection in <cors> Namespace Add CorsFilterFactoryBean so the <cors> XML element can detect a CorsConfigurationSource or PreFlightRequestHandler bean implicitly, matching CorsConfigurer's existing Java config behavior. Closes gh-19542 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 11:53:36 -06:00
Josh Cummings	8876c30b00	Disable Lowercase HTTP Method Firewall Test Spring Framework's HttpMethod#valueOf now normalizes casing, so StrictServerWebExchangeFirewall no longer detects a non-canonical-case HTTP method as distinct from its canonical form. Closes gh-19541 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-13 11:51:30 -06:00
Josh Cummings	94d36e603b	Merge branch '7.1.x' Closes gh-19540	2026-08-13 11:37:03 -06:00
dependabot[bot]	329e9e6d71	Bump org.apache.httpcomponents.client5:httpclient5 from 5.6.3 to 5.6.4 Bumps [org.apache.httpcomponents.client5:httpclient5](https://github.com/apache/httpcomponents-client) from 5.6.3 to 5.6.4. - [Changelog](https://github.com/apache/httpcomponents-client/blob/rel/v5.6.4/RELEASE_NOTES.txt) - [Commits](https://github.com/apache/httpcomponents-client/compare/rel/v5.6.3...rel/v5.6.4) --- updated-dependencies: - dependency-name: org.apache.httpcomponents.client5:httpclient5 dependency-version: 5.6.4 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-13 03:18:39 +00:00
Josh Cummings	09a3280442	Merge branch '7.1.x'	2026-08-11 19:41:02 -06:00
Josh Cummings	88aedba0bf	Update What's New Issue gh-17655 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 16:30:43 -06:00
Josh Cummings	f95a956345	Merge branch '7.1.x'	2026-08-11 16:20:05 -06:00
Josh Cummings	30cc0f21a9	Fix Documentation Sample Structure Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 15:18:49 -07:00
Josh Cummings	c096e45242	Support Account Status Checks in OneTimeTokenReactiveAuthenticationManager Add the same opt-in UserDetailsChecker support to OneTimeTokenReactiveAuthenticationManager, mirroring OneTimeTokenAuthenticationProvider for the reactive stack. Issue gh-17655 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 15:18:49 -07:00
Josh Cummings	b3e262187c	Make OneTimeTokenAuthenticationProvider Account Status Checks Opt-In OneTimeTokenAuthenticationProvider no longer validates account status by default. Applications can opt in via setUserDetailsChecker, for example by providing AccountStatusUserDetailsChecker to reject locked, disabled, or expired accounts. Issue gh-17655 Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 15:18:49 -07:00
Andrey Litvitski	64fa98da1a	Validate account status in OneTimeTokenAuthenticationProvider The main problem is that OneTimeTokenAuthenticationProvider does not extend from AbstractUserDetailsAuthenticationProvider, which has a preauthentication check for user details. However, we do not need to extend from it because it does not fit the context of the class. In this regard, I decided to add my own checker to this commit, which performs a preauthentication check before authorizing the account, similar to how it is done in AbstractUserDetailsAuthenticationProvider. I also added a test to OneTimeTokenAuthenticationProviderTests that identifies this problem. Closes gh-17655 Signed-off-by: Andrey Litvitski <andrey1010102008@gmail.com>	2026-08-11 15:18:49 -07:00
Josh Cummings	26b20b2dd2	Merge branch '7.1.x'	2026-08-11 14:00:54 -06:00
dependabot[bot]	e4d43fb89a	Bump com.nimbusds:oauth2-oidc-sdk from 11.38.1 to 11.38.2 Bumps [com.nimbusds:oauth2-oidc-sdk](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions) from 11.38.1 to 11.38.2 and com.nimbusds:nimbus-jose-jwt from 10.9 to 10.9.1, which oauth2-oidc-sdk 11.38.2 requires. - [Changelog](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/src/master/CHANGELOG.txt) - [Commits](https://bitbucket.org/connect2id/oauth-2.0-sdk-with-openid-connect-extensions/branches/compare/11.38.2..11.38.1) --- updated-dependencies: - dependency-name: com.nimbusds:oauth2-oidc-sdk dependency-version: 11.38.2 dependency-type: direct:production update-type: version-update:semver-patch - dependency-name: com.nimbusds:nimbus-jose-jwt dependency-version: 10.9.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-11 17:59:52 +00:00
Josh Cummings	04c08bb42a	Merge branch '7.1.x'	2026-08-11 11:09:29 -06:00
Josh Cummings	73c93cebaf	Remove 6.5.x from Dependabot Signed-off-by: Josh Cummings <3627351+jzheaux@users.noreply.github.com>	2026-08-11 10:25:22 -06:00
Josh Cummings	3c6df7df1f	Update to 7.2.0-SNAPSHOT	2026-08-11 10:25:22 -06:00
dependabot[bot]	70b161c772	Bump org.junit:junit-bom from 6.1.2 to 6.1.3 Bumps [org.junit:junit-bom](https://github.com/junit-team/junit-framework) from 6.1.2 to 6.1.3. - [Release notes](https://github.com/junit-team/junit-framework/releases) - [Commits](https://github.com/junit-team/junit-framework/compare/r6.1.2...r6.1.3) --- updated-dependencies: - dependency-name: org.junit:junit-bom dependency-version: 6.1.3 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>	2026-08-11 03:24:26 +00:00