Release 6.5.2

Closes gh-17580

config/src/main/java/org/springframework/security/config/annotation/AbstractConfiguredSecurityBuilder.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -50,6 +50,7 @@ import org.springframework.web.filter.DelegatingFilterProxy;
  * @param <O> The object that this builder returns
  * @param <B> The type of this builder (that is returned by the base class)
  * @author Rob Winch
+ * @author DingHao
  * @see WebSecurity
  */
 public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBuilder<O>>
@@ -59,7 +60,7 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 
 	private final LinkedHashMap<Class<? extends SecurityConfigurer<O, B>>, List<SecurityConfigurer<O, B>>> configurers = new LinkedHashMap<>();
 
-	private final List<SecurityConfigurer<O, B>> configurersAddedInInitializing = new ArrayList<>();
+	private List<SecurityConfigurer<O, B>> configurersAddedInInitializing = new ArrayList<>();
 
 	private final Map<Class<?>, Object> sharedObjects = new HashMap<>();
 
@@ -386,8 +387,12 @@ public abstract class AbstractConfiguredSecurityBuilder<O, B extends SecurityBui
 		for (SecurityConfigurer<O, B> configurer : configurers) {
 			configurer.init((B) this);
 		}
-		for (SecurityConfigurer<O, B> configurer : this.configurersAddedInInitializing) {
-			configurer.init((B) this);
+		while (!this.configurersAddedInInitializing.isEmpty()) {
+			List<SecurityConfigurer<O, B>> toInit = this.configurersAddedInInitializing;
+			this.configurersAddedInInitializing = new ArrayList<>();
+			for (SecurityConfigurer<O, B> configurer : toInit) {
+				configurer.init((B) this);
+			}
 		}
 	}
 

config/src/main/java/org/springframework/security/config/annotation/method/configuration/ReactiveMethodSecuritySelector.java

@@ -38,9 +38,6 @@ class ReactiveMethodSecuritySelector implements ImportSelector {
 	private static final boolean isDataPresent = ClassUtils
 		.isPresent("org.springframework.security.data.aot.hint.AuthorizeReturnObjectDataHintsRegistrar", null);
 
-	private static final boolean isWebPresent = ClassUtils.isPresent("org.springframework.web.server.ServerWebExchange",
-			null);
-
 	private static final boolean isObservabilityPresent = ClassUtils
 		.isPresent("io.micrometer.observation.ObservationRegistry", null);
 
@@ -64,9 +61,6 @@ class ReactiveMethodSecuritySelector implements ImportSelector {
 		if (isDataPresent) {
 			imports.add(AuthorizationProxyDataConfiguration.class.getName());
 		}
-		if (isWebPresent) {
-			imports.add(AuthorizationProxyWebConfiguration.class.getName());
-		}
 		if (isObservabilityPresent) {
 			imports.add(ReactiveMethodObservationConfiguration.class.getName());
 		}

config/src/main/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurer.java

@@ -181,6 +181,8 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 
 	private OAuth2AuthorizedClientRepository authorizedClientRepository;
 
+	private SecurityContextRepository securityContextRepository;
+
 	/**
 	 * Sets the repository of client registrations.
 	 * @param clientRegistrationRepository the repository of client registrations
@@ -234,6 +236,17 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 		return this;
 	}
 
+	/**
+	 * Sets the {@link SecurityContextRepository} to use.
+	 * @param securityContextRepository the {@link SecurityContextRepository} to use
+	 * @return the {@link OAuth2LoginConfigurer} for further configuration
+	 */
+	@Override
+	public OAuth2LoginConfigurer<B> securityContextRepository(SecurityContextRepository securityContextRepository) {
+		this.securityContextRepository = securityContextRepository;
+		return this;
+	}
+
 	/**
 	 * Sets the registry for managing the OIDC client-provider session link
 	 * @param oidcSessionRegistry the {@link OidcSessionRegistry} to use
@@ -354,6 +367,9 @@ public final class OAuth2LoginConfigurer<B extends HttpSecurityBuilder<B>>
 		RequestMatcher processUri = RequestMatcherFactory.matcher(this.loginProcessingUrl);
 		authenticationFilter.setRequiresAuthenticationRequestMatcher(processUri);
 		authenticationFilter.setSecurityContextHolderStrategy(getSecurityContextHolderStrategy());
+		if (this.securityContextRepository != null) {
+			authenticationFilter.setSecurityContextRepository(this.securityContextRepository);
+		}
 		this.setAuthenticationFilter(authenticationFilter);
 		super.loginProcessingUrl(this.loginProcessingUrl);
 		if (this.loginPage != null) {

config/src/main/java/org/springframework/security/config/http/MessageMatcherFactoryBean.java

@@ -0,0 +1,78 @@
+/*
+ * Copyright 2002-2025 the original author or authors.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.springframework.security.config.http;
+
+import org.springframework.beans.BeansException;
+import org.springframework.beans.factory.FactoryBean;
+import org.springframework.context.ApplicationContext;
+import org.springframework.context.ApplicationContextAware;
+import org.springframework.messaging.simp.SimpMessageType;
+import org.springframework.security.messaging.util.matcher.MessageMatcher;
+import org.springframework.security.messaging.util.matcher.PathPatternMessageMatcher;
+import org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher;
+import org.springframework.util.AntPathMatcher;
+import org.springframework.util.PathMatcher;
+
+@Deprecated
+public final class MessageMatcherFactoryBean implements FactoryBean<MessageMatcher<?>>, ApplicationContextAware {
+
+	private PathPatternMessageMatcher.Builder builder;
+
+	private final SimpMessageType method;
+
+	private final String path;
+
+	private PathMatcher pathMatcher = new AntPathMatcher();
+
+	public MessageMatcherFactoryBean(String path) {
+		this(path, null);
+	}
+
+	public MessageMatcherFactoryBean(String path, SimpMessageType method) {
+		this.method = method;
+		this.path = path;
+	}
+
+	@Override
+	public MessageMatcher<?> getObject() throws Exception {
+		if (this.builder != null) {
+			return this.builder.matcher(this.method, this.path);
+		}
+		if (this.method == SimpMessageType.SUBSCRIBE) {
+			return SimpDestinationMessageMatcher.createSubscribeMatcher(this.path, this.pathMatcher);
+		}
+		if (this.method == SimpMessageType.MESSAGE) {
+			return SimpDestinationMessageMatcher.createMessageMatcher(this.path, this.pathMatcher);
+		}
+		return new SimpDestinationMessageMatcher(this.path, this.pathMatcher);
+	}
+
+	@Override
+	public Class<?> getObjectType() {
+		return null;
+	}
+
+	public void setPathMatcher(PathMatcher pathMatcher) {
+		this.pathMatcher = pathMatcher;
+	}
+
+	@Override
+	public void setApplicationContext(ApplicationContext context) throws BeansException {
+		this.builder = context.getBeanProvider(PathPatternMessageMatcher.Builder.class).getIfUnique();
+	}
+
+}

config/src/main/java/org/springframework/security/config/web/messaging/PathPatternMessageMatcherBuilderFactoryBean.java

@@ -19,6 +19,7 @@ package org.springframework.security.config.web.messaging;
 import org.springframework.beans.factory.FactoryBean;
 import org.springframework.security.messaging.access.intercept.MessageMatcherDelegatingAuthorizationManager;
 import org.springframework.security.messaging.util.matcher.PathPatternMessageMatcher;
+import org.springframework.web.util.pattern.PathPatternParser;
 
 /**
  * Use this factory bean to configure the {@link PathPatternMessageMatcher.Builder} bean
@@ -31,9 +32,30 @@ import org.springframework.security.messaging.util.matcher.PathPatternMessageMat
 public final class PathPatternMessageMatcherBuilderFactoryBean
 		implements FactoryBean<PathPatternMessageMatcher.Builder> {
 
+	private PathPatternParser parser;
+
+	/**
+	 * Create {@link PathPatternMessageMatcher}s using
+	 * {@link PathPatternParser#defaultInstance}
+	 */
+	public PathPatternMessageMatcherBuilderFactoryBean() {
+
+	}
+
+	/**
+	 * Create {@link PathPatternMessageMatcher}s using the given {@link PathPatternParser}
+	 * @param parser the {@link PathPatternParser} to use
+	 */
+	public PathPatternMessageMatcherBuilderFactoryBean(PathPatternParser parser) {
+		this.parser = parser;
+	}
+
 	@Override
 	public PathPatternMessageMatcher.Builder getObject() throws Exception {
-		return PathPatternMessageMatcher.withDefaults();
+		if (this.parser == null) {
+			return PathPatternMessageMatcher.withDefaults();
+		}
+		return PathPatternMessageMatcher.withPathPatternParser(this.parser);
 	}
 
 	@Override

config/src/main/java/org/springframework/security/config/websocket/WebSocketMessageBrokerSecurityBeanDefinitionParser.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -50,6 +50,7 @@ import org.springframework.security.access.vote.ConsensusBased;
 import org.springframework.security.authorization.AuthorizationDecision;
 import org.springframework.security.authorization.AuthorizationManager;
 import org.springframework.security.config.Elements;
+import org.springframework.security.config.http.MessageMatcherFactoryBean;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.context.SecurityContextHolder;
 import org.springframework.security.core.context.SecurityContextHolderStrategy;
@@ -63,7 +64,6 @@ import org.springframework.security.messaging.access.intercept.MessageMatcherDel
 import org.springframework.security.messaging.context.AuthenticationPrincipalArgumentResolver;
 import org.springframework.security.messaging.context.SecurityContextChannelInterceptor;
 import org.springframework.security.messaging.util.matcher.MessageMatcher;
-import org.springframework.security.messaging.util.matcher.SimpDestinationMessageMatcher;
 import org.springframework.security.messaging.util.matcher.SimpMessageTypeMatcher;
 import org.springframework.security.messaging.web.csrf.CsrfChannelInterceptor;
 import org.springframework.security.messaging.web.socket.server.CsrfTokenHandshakeInterceptor;
@@ -270,25 +270,18 @@ public final class WebSocketMessageBrokerSecurityBeanDefinitionParser implements
 			matcher.addConstructorArgValue(messageType);
 			return matcher.getBeanDefinition();
 		}
-		String factoryName = null;
-		if (hasPattern && hasMessageType) {
+		BeanDefinitionBuilder matcher = BeanDefinitionBuilder.rootBeanDefinition(MessageMatcherFactoryBean.class);
+		matcher.addConstructorArgValue(matcherPattern);
+		if (hasMessageType) {
 			SimpMessageType type = SimpMessageType.valueOf(messageType);
-			if (SimpMessageType.MESSAGE == type) {
-				factoryName = "createMessageMatcher";
-			}
-			else if (SimpMessageType.SUBSCRIBE == type) {
-				factoryName = "createSubscribeMatcher";
-			}
-			else {
+			matcher.addConstructorArgValue(type);
+			if (SimpMessageType.SUBSCRIBE != type && SimpMessageType.MESSAGE != type) {
 				parserContext.getReaderContext()
 					.error("Cannot use intercept-websocket@message-type=" + messageType
 							+ " with a pattern because the type does not have a destination.", interceptMessage);
 			}
 		}
-		BeanDefinitionBuilder matcher = BeanDefinitionBuilder.rootBeanDefinition(SimpDestinationMessageMatcher.class);
-		matcher.setFactoryMethod(factoryName);
-		matcher.addConstructorArgValue(matcherPattern);
-		matcher.addConstructorArgValue(new RuntimeBeanReference("springSecurityMessagePathMatcher"));
+		matcher.addPropertyValue("pathMatcher", new RuntimeBeanReference("springSecurityMessagePathMatcher"));
 		return matcher.getBeanDefinition();
 	}
 
@@ -301,6 +294,8 @@ public final class WebSocketMessageBrokerSecurityBeanDefinitionParser implements
 
 		private static final String CLIENT_INBOUND_CHANNEL_BEAN_ID = "clientInboundChannel";
 
+		private static final String CSRF_CHANNEL_INTERCEPTOR_BEAN_ID = "csrfChannelInterceptor";
+
 		private static final String INTERCEPTORS_PROP = "interceptors";
 
 		private static final String CUSTOM_ARG_RESOLVERS_PROP = "customArgumentResolvers";
@@ -364,7 +359,12 @@ public final class WebSocketMessageBrokerSecurityBeanDefinitionParser implements
 			ManagedList<Object> interceptors = new ManagedList();
 			interceptors.add(new RootBeanDefinition(SecurityContextChannelInterceptor.class));
 			if (!this.sameOriginDisabled) {
-				interceptors.add(new RootBeanDefinition(CsrfChannelInterceptor.class));
+				if (!registry.containsBeanDefinition(CSRF_CHANNEL_INTERCEPTOR_BEAN_ID)) {
+					interceptors.add(new RootBeanDefinition(CsrfChannelInterceptor.class));
+				}
+				else {
+					interceptors.add(new RuntimeBeanReference(CSRF_CHANNEL_INTERCEPTOR_BEAN_ID));
+				}
 			}
 			interceptors.add(registry.getBeanDefinition(this.inboundSecurityInterceptorId));
 			BeanDefinition inboundChannel = registry.getBeanDefinition(CLIENT_INBOUND_CHANNEL_BEAN_ID);

config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostReactiveMethodSecurityConfigurationTests.java

@@ -40,8 +40,6 @@ import org.springframework.beans.factory.support.BeanDefinitionRegistryPostProce
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.Role;
-import org.springframework.http.HttpStatusCode;
-import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.annotation.Secured;
@@ -67,7 +65,6 @@ import org.springframework.security.test.context.annotation.SecurityTestExecutio
 import org.springframework.security.test.context.support.WithMockUser;
 import org.springframework.stereotype.Component;
 import org.springframework.test.context.junit.jupiter.SpringExtension;
-import org.springframework.web.servlet.ModelAndView;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -364,48 +361,6 @@ public class PrePostReactiveMethodSecurityConfigurationTests {
 		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> flight.getAltitude().block());
 	}
 
-	@Test
-	@WithMockUser(authorities = "airplane:read")
-	public void findByIdWhenAuthorizedResponseEntityThenAuthorizes() {
-		this.spring.register(AuthorizeResultConfig.class).autowire();
-		FlightRepository flights = this.spring.getContext().getBean(FlightRepository.class);
-		Flight flight = flights.webFindById("1").block().getBody();
-		assertThatNoException().isThrownBy(() -> flight.getAltitude().block());
-		assertThatNoException().isThrownBy(() -> flight.getSeats().block());
-	}
-
-	@Test
-	@WithMockUser(authorities = "seating:read")
-	public void findByIdWhenUnauthorizedResponseEntityThenDenies() {
-		this.spring.register(AuthorizeResultConfig.class).autowire();
-		FlightRepository flights = this.spring.getContext().getBean(FlightRepository.class);
-		Flight flight = flights.webFindById("1").block().getBody();
-		assertThatNoException().isThrownBy(() -> flight.getSeats().block());
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> flight.getAltitude().block());
-	}
-
-	@Test
-	@WithMockUser(authorities = "airplane:read")
-	public void findByIdWhenAuthorizedModelAndViewThenAuthorizes() {
-		this.spring.register(AuthorizeResultConfig.class).autowire();
-		FlightRepository flights = this.spring.getContext().getBean(FlightRepository.class);
-		Flight flight = (Flight) flights.webViewFindById("1").block().getModel().get("flight");
-		assertThatNoException().isThrownBy(() -> flight.getAltitude().block());
-		assertThatNoException().isThrownBy(() -> flight.getSeats().block());
-		assertThat(flights.webViewFindById("5").block().getModel().get("flight")).isNull();
-	}
-
-	@Test
-	@WithMockUser(authorities = "seating:read")
-	public void findByIdWhenUnauthorizedModelAndViewThenDenies() {
-		this.spring.register(AuthorizeResultConfig.class).autowire();
-		FlightRepository flights = this.spring.getContext().getBean(FlightRepository.class);
-		Flight flight = (Flight) flights.webViewFindById("1").block().getModel().get("flight");
-		assertThatNoException().isThrownBy(() -> flight.getSeats().block());
-		assertThatExceptionOfType(AccessDeniedException.class).isThrownBy(() -> flight.getAltitude().block());
-		assertThat(flights.webViewFindById("5").block().getModel().get("flight")).isNull();
-	}
-
 	@Test
 	@WithMockUser(authorities = "seating:read")
 	public void findAllWhenUnauthorizedResultThenDenies() {
@@ -769,22 +724,6 @@ public class PrePostReactiveMethodSecurityConfigurationTests {
 			return Mono.empty();
 		}
 
-		Mono<ResponseEntity<Flight>> webFindById(String id) {
-			Flight flight = this.flights.get(id);
-			if (flight == null) {
-				return Mono.just(ResponseEntity.notFound().build());
-			}
-			return Mono.just(ResponseEntity.ok(flight));
-		}
-
-		Mono<ModelAndView> webViewFindById(String id) {
-			Flight flight = this.flights.get(id);
-			if (flight == null) {
-				return Mono.just(new ModelAndView("error", HttpStatusCode.valueOf(404)));
-			}
-			return Mono.just(new ModelAndView("flights", Map.of("flight", flight)));
-		}
-
 	}
 
 	@AuthorizeReturnObject

config/src/test/java/org/springframework/security/config/annotation/web/AbstractConfiguredSecurityBuilderTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2023 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -163,6 +163,36 @@ public class AbstractConfiguredSecurityBuilderTests {
 		assertThat(this.builder.getConfigurers(TestSecurityConfigurer.class)).hasSize(1);
 	}
 
+	@Test
+	public void withWhenConfigurerAddInitializing() throws Exception {
+		this.builder.with(new AppliesNestedConfigurer(), Customizer.withDefaults());
+		assertThat(this.builder.build()).isEqualTo("success");
+	}
+
+	private static class AppliesNestedConfigurer
+			extends SecurityConfigurerAdapter<Object, TestConfiguredSecurityBuilder> {
+
+		@Override
+		public void init(TestConfiguredSecurityBuilder builder) throws Exception {
+			builder.with(new NestedConfigurer(), Customizer.withDefaults());
+		}
+
+	}
+
+	private static class NestedConfigurer extends SecurityConfigurerAdapter<Object, TestConfiguredSecurityBuilder> {
+
+		@Override
+		public void init(TestConfiguredSecurityBuilder http) throws Exception {
+			http.with(new DoubleNestedConfigurer(), Customizer.withDefaults());
+		}
+
+	}
+
+	private static class DoubleNestedConfigurer
+			extends SecurityConfigurerAdapter<Object, TestConfiguredSecurityBuilder> {
+
+	}
+
 	private static class ApplyAndRemoveSecurityConfigurer
 			extends SecurityConfigurerAdapter<Object, TestConfiguredSecurityBuilder> {
 

config/src/test/java/org/springframework/security/config/annotation/web/configurers/oauth2/client/OAuth2LoginConfigurerTests.java

@@ -105,6 +105,7 @@ import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.security.web.authentication.HttpStatusEntryPoint;
 import org.springframework.security.web.context.HttpRequestResponseHolder;
 import org.springframework.security.web.context.HttpSessionSecurityContextRepository;
+import org.springframework.security.web.context.NullSecurityContextRepository;
 import org.springframework.security.web.context.SecurityContextRepository;
 import org.springframework.security.web.session.HttpSessionDestroyedEvent;
 import org.springframework.security.web.util.matcher.RequestHeaderRequestMatcher;
@@ -114,6 +115,7 @@ import org.springframework.web.context.support.AnnotationConfigWebApplicationCon
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
+import static org.assertj.core.api.Assertions.assertThatNoException;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.ArgumentMatchers.anyString;
 import static org.mockito.BDDMockito.given;
@@ -729,6 +731,12 @@ public class OAuth2LoginConfigurerTests {
 		verify(this.context.getBean(SpyObjectPostProcessor.class).spy).authenticate(any());
 	}
 
+	// gh-16623
+	@Test
+	public void oauth2LoginWithCustomSecurityContextRepository() {
+		assertThatNoException().isThrownBy(() -> loadConfig(OAuth2LoginConfigSecurityContextRepository.class));
+	}
+
 	private void loadConfig(Class<?>... configs) {
 		AnnotationConfigWebApplicationContext applicationContext = new AnnotationConfigWebApplicationContext();
 		applicationContext.register(configs);
@@ -977,6 +985,24 @@ public class OAuth2LoginConfigurerTests {
 
 	}
 
+	@Configuration
+	@EnableWebSecurity
+	static class OAuth2LoginConfigSecurityContextRepository extends CommonSecurityFilterChainConfig {
+
+		@Bean
+		SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+			// @formatter:off
+			http
+				.oauth2Login((login) -> login
+					.clientRegistrationRepository(
+							new InMemoryClientRegistrationRepository(GOOGLE_CLIENT_REGISTRATION))
+					.securityContextRepository(new NullSecurityContextRepository()));
+			// @formatter:on
+			return super.configureFilterChain(http);
+		}
+
+	}
+
 	@Configuration
 	@EnableWebSecurity
 	static class OAuth2LoginConfigCustomAuthorizationRequestResolver extends CommonSecurityFilterChainConfig {

config/src/test/java/org/springframework/security/config/websocket/WebSocketMessageBrokerConfigTests.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2002-2024 the original author or authors.
+ * Copyright 2002-2025 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -48,6 +48,7 @@ import org.springframework.messaging.handler.invocation.HandlerMethodArgumentRes
 import org.springframework.messaging.simp.SimpMessageHeaderAccessor;
 import org.springframework.messaging.simp.SimpMessageType;
 import org.springframework.messaging.support.ChannelInterceptor;
+import org.springframework.messaging.support.ExecutorSubscribableChannel;
 import org.springframework.messaging.support.GenericMessage;
 import org.springframework.security.access.AccessDeniedException;
 import org.springframework.security.access.expression.SecurityExpressionOperations;
@@ -333,6 +334,32 @@ public class WebSocketMessageBrokerConfigTests {
 			.withCauseInstanceOf(AccessDeniedException.class);
 	}
 
+	@Test
+	public void sendWhenPathPatternFactoryBeanThenConstructsPatternsWithPathPattern() {
+		this.spring.configLocations(xml("SubscribeInterceptTypePathPattern")).autowire();
+		Message<?> message = message("/permitAll", SimpMessageType.SUBSCRIBE);
+		send(message);
+		message = message("/permitAll", SimpMessageType.UNSUBSCRIBE);
+		assertThatExceptionOfType(Exception.class).isThrownBy(send(message))
+			.withCauseInstanceOf(AccessDeniedException.class);
+		message = message("/anyOther", SimpMessageType.SUBSCRIBE);
+		assertThatExceptionOfType(Exception.class).isThrownBy(send(message))
+			.withCauseInstanceOf(AccessDeniedException.class);
+	}
+
+	@Test
+	public void sendWhenCaseInsensitivePathPatternParserThenMatchesMixedCase() {
+		this.spring.configLocations(xml("SubscribeInterceptTypePathPatternParser")).autowire();
+		Message<?> message = message("/peRmItAll", SimpMessageType.SUBSCRIBE);
+		send(message);
+		message = message("/peRmKtAll", SimpMessageType.UNSUBSCRIBE);
+		assertThatExceptionOfType(Exception.class).isThrownBy(send(message))
+			.withCauseInstanceOf(AccessDeniedException.class);
+		message = message("/aNyOtHer", SimpMessageType.SUBSCRIBE);
+		assertThatExceptionOfType(Exception.class).isThrownBy(send(message))
+			.withCauseInstanceOf(AccessDeniedException.class);
+	}
+
 	@Test
 	public void configureWhenUsingConnectMessageTypeThenAutowireFails() {
 		assertThatExceptionOfType(BeanDefinitionParsingException.class)
@@ -521,6 +548,16 @@ public class WebSocketMessageBrokerConfigTests {
 		verify(authorizationManager).check(any(), any());
 	}
 
+	@Test
+	public void configureWhenCsrfChannelInterceptorBeanThenUses() {
+		this.spring.configLocations(xml("CustomCsrfInterceptor")).autowire();
+		ExecutorSubscribableChannel channel = this.spring.getContext()
+			.getBean("clientInboundChannel", ExecutorSubscribableChannel.class);
+		ChannelInterceptor interceptor = this.spring.getContext()
+			.getBean("csrfChannelInterceptor", ChannelInterceptor.class);
+		assertThat(channel.getInterceptors()).contains(interceptor);
+	}
+
 	private String xml(String configName) {
 		return CONFIG_LOCATION_PREFIX + "-" + configName + ".xml";
 	}

config/src/test/resources/org/springframework/security/config/websocket/WebSocketMessageBrokerConfigTests-CustomCsrfInterceptor.xml

@@ -0,0 +1,34 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2002-2018 the original author or authors.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<b:beans xmlns:b="http://www.springframework.org/schema/beans"
+		 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		 xmlns="http://www.springframework.org/schema/security"
+		 xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
+		http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
+
+	<b:import resource="classpath:org/springframework/security/config/websocket/controllers.xml"/>
+	<b:import resource="classpath:org/springframework/security/config/websocket/websocket.xml"/>
+
+	<b:bean id="csrfChannelInterceptor" class="org.mockito.Mockito" factory-method="mock">
+		<b:constructor-arg value="org.springframework.messaging.support.ChannelInterceptor"  type="java.lang.Class"/>
+	</b:bean>
+
+	<websocket-message-broker use-authorization-manager="false">
+		<intercept-message pattern="/**" access="denyNile()"/>
+	</websocket-message-broker>
+
+</b:beans>

config/src/test/resources/org/springframework/security/config/websocket/WebSocketMessageBrokerConfigTests-SubscribeInterceptTypePathPattern.xml

@@ -0,0 +1,32 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2002-2018 the original author or authors.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<b:beans xmlns:b="http://www.springframework.org/schema/beans"
+		 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		 xmlns="http://www.springframework.org/schema/security"
+		 xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
+		http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
+
+	<b:import resource="classpath:org/springframework/security/config/websocket/controllers.xml"/>
+	<b:import resource="classpath:org/springframework/security/config/websocket/websocket.xml"/>
+
+	<websocket-message-broker>
+		<intercept-message pattern="/permitAll" type="SUBSCRIBE" access="permitAll"/>
+		<intercept-message pattern="/**" access="denyAll"/>
+	</websocket-message-broker>
+
+	<b:bean class="org.springframework.security.config.web.messaging.PathPatternMessageMatcherBuilderFactoryBean"/>
+</b:beans>

config/src/test/resources/org/springframework/security/config/websocket/WebSocketMessageBrokerConfigTests-SubscribeInterceptTypePathPatternParser.xml

@@ -0,0 +1,38 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ Copyright 2002-2018 the original author or authors.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~      https://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<b:beans xmlns:b="http://www.springframework.org/schema/beans"
+		 xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+		 xmlns="http://www.springframework.org/schema/security"
+		 xsi:schemaLocation="http://www.springframework.org/schema/security https://www.springframework.org/schema/security/spring-security.xsd
+		http://www.springframework.org/schema/beans https://www.springframework.org/schema/beans/spring-beans.xsd">
+
+	<b:import resource="classpath:org/springframework/security/config/websocket/controllers.xml"/>
+	<b:import resource="classpath:org/springframework/security/config/websocket/websocket.xml"/>
+
+	<websocket-message-broker>
+		<intercept-message pattern="/permitAll" type="SUBSCRIBE" access="permitAll"/>
+		<intercept-message pattern="/**" access="denyAll"/>
+	</websocket-message-broker>
+
+	<b:bean name="pathPatternParser" class="org.springframework.web.util.pattern.PathPatternParser">
+		<b:property name="caseSensitive" value="false"/>
+	</b:bean>
+
+	<b:bean class="org.springframework.security.config.web.messaging.PathPatternMessageMatcherBuilderFactoryBean">
+		<b:constructor-arg ref="pathPatternParser"/>
+	</b:bean>
+</b:beans>

docs/modules/ROOT/pages/migration-7/messaging.adoc

@@ -0,0 +1,86 @@
+== Messaging Migrations
+
+[[use-path-pattern]]
+== Use PathPatternMessageMatcher by Default
+
+In Spring Security 7, `SimpDestMessageMatcher` is no longer supported and will use `PathPatternMessageMatcher` by default.
+
+To check how prepared you are for this change, you can publish this bean:
+
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Bean
+PathPatternMessageMatcherBuilderFactoryBean messageMatcherBuilder() {
+	return new PathPatternMessageMatcherBuilderFactoryBean();
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun messageMatcherBuilder(): PathPatternMessageMatcherBuilderFactoryBean {
+    return PathPatternMessageMatcherBuilderFactoryBean()
+}
+----
+
+Xml::
++
+[source,xml,role="secondary"]
+----
+<b:bean class="org.springframework.security.config.web.messaging.PathPatternMessageMatcherBuilderFactoryBean"/>
+----
+======
+
+This will tell the Spring Security DSL to use `PathPatternMessageMatcher` for all message matchers that it constructs.
+
+Use of `PathMatcher` is no longer supported in 7.
+If you are using `PathMatcher` to change the path separator or to change case sensitivity for message matching, you can configure the `PathPatternParser` to do this instead like so:
+
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Bean
+PathPatternMessageMatcherBuilderFactoryBean messageMatcherBuilder() {
+	PathPatternParser pathPatternParser = new PathPatternParser();
+	pathPatternParser.setCaseSensitive(false);
+	// use . as path separator
+	pathPatternParser.setPathOptions(PathContainer.Options.MESSAGE_ROUTE);
+	return new PathPatternMessageMatcherBuilderFactoryBean(pathPatternParser);
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun messageMatcherBuilder(): PathPatternMessageMatcherBuilderFactoryBean {
+    val pathPatternParser = PathPatternParser()
+	pathPatternParser.setCaseSensitive(false)
+    // use . as path separator
+	pathPatternParser.setPathOptions(PathContainer.Options.MESSAGE_ROUTE)
+    return PathPatternMessageMatcherBuilderFactoryBean(pathPatternParser)
+}
+----
+
+Xml::
++
+[source,xml,role="secondary"]
+----
+<b:bean class="org.springframework.web.util.pattern.PathPatternParser">
+    <b:property name="caseSensitive" value="false"/>
+    <!-- use . as path separator -->
+    <b:property name="pathOptions" value="#{T(org.springframework.http.server.PathContainer.Options).MESSAGE_ROUTE"/>
+</b:bean>
+<b:bean class="org.springframework.security.config.web.messaging.PathPatternMessageMatcherBuilderFactoryBean"/>
+----
+======

docs/modules/ROOT/pages/servlet/saml2/login/authentication.adoc

@@ -542,7 +542,7 @@ For example, you can throw a custom exception with any additional information av
 ----
 OpenSaml4AuthenticationProvider provider = new OpenSaml4AuthenticationProvider();
 provider.setResponseValidator((responseToken) -> {
-	Saml2ResponseValidatorResult result = OpenSamlAuthenticationProvider
+	Saml2ResponseValidatorResult result = OpenSaml4AuthenticationProvider
 		.createDefaultResponseValidator()
 		.convert(responseToken)
 		.concat(myCustomValidator.convert(responseToken));

docs/modules/ROOT/pages/servlet/saml2/login/overview.adoc

@@ -49,7 +49,7 @@ This filter calls its configured `AuthenticationConverter` to create a `Saml2Aut
 This converter additionally resolves the <<servlet-saml2login-relyingpartyregistration, `RelyingPartyRegistration`>> and supplies it to `Saml2AuthenticationToken`.
 
 image:{icondir}/number_2.png[] Next, the filter passes the token to its configured xref:servlet/authentication/architecture.adoc#servlet-authentication-providermanager[`AuthenticationManager`].
-By default, it uses the <<servlet-saml2login-architecture,`OpenSamlAuthenticationProvider`>>.
+By default, it uses the <<servlet-saml2login-architecture,`OpenSaml4AuthenticationProvider`>>.
 
 image:{icondir}/number_3.png[] If authentication fails, then _Failure_.
 
@@ -184,9 +184,9 @@ To achieve this, any interfaces or classes where Spring Security uses OpenSAML i
 This makes it possible for you to switch out OpenSAML for some other library or an unsupported version of OpenSAML.
 
 As a natural outcome of these two goals, Spring Security's SAML API is quite small relative to other modules.
-Instead, such classes as `OpenSamlAuthenticationRequestFactory` and `OpenSamlAuthenticationProvider` expose `Converter` implementations that customize various steps in the authentication process.
+Instead, such classes as `OpenSamlXAuthenticationRequestFactory` and `OpenSamlXAuthenticationProvider` expose `Converter` implementations that customize various steps in the authentication process.
 
-For example, once your application receives a `SAMLResponse` and delegates to `Saml2WebSsoAuthenticationFilter`, the filter delegates to `OpenSamlAuthenticationProvider`:
+For example, once your application receives a `SAMLResponse` and delegates to `Saml2WebSsoAuthenticationFilter`, the filter delegates to `OpenSamlXAuthenticationProvider`:
 
 .Authenticating an OpenSAML `Response`
 image:{figures}/opensamlauthenticationprovider.png[]

docs/modules/ROOT/pages/servlet/saml2/logout.adoc

@@ -510,7 +510,7 @@ Java::
 ----
 @Component
 public class MyOpenSamlLogoutRequestValidator implements Saml2LogoutRequestValidator {
-	private final Saml2LogoutRequestValidator delegate = new OpenSamlLogoutRequestValidator();
+	private final Saml2LogoutRequestValidator delegate = new OpenSaml5LogoutRequestValidator();
 
 	@Override
     public Saml2LogoutRequestValidator logout(Saml2LogoutRequestValidatorParameters parameters) {
@@ -529,7 +529,7 @@ Kotlin::
 ----
 @Component
 open class MyOpenSamlLogoutRequestValidator: Saml2LogoutRequestValidator {
-	private val delegate = OpenSamlLogoutRequestValidator()
+	private val delegate = OpenSaml5LogoutRequestValidator()
 
 	@Override
     fun logout(parameters: Saml2LogoutRequestValidatorParameters): Saml2LogoutRequestValidator {
@@ -586,7 +586,7 @@ Java::
 ----
 @Component
 public class MyOpenSamlLogoutResponseValidator implements Saml2LogoutResponseValidator {
-	private final Saml2LogoutResponseValidator delegate = new OpenSamlLogoutResponseValidator();
+	private final Saml2LogoutResponseValidator delegate = new OpenSaml5LogoutResponseValidator();
 
 	@Override
     public Saml2LogoutValidatorResult logout(Saml2LogoutResponseValidatorParameters parameters) {

docs/modules/ROOT/pages/servlet/saml2/metadata.adoc

@@ -58,7 +58,7 @@ public class RefreshableRelyingPartyRegistrationRepository
         implements IterableRelyingPartyRegistrationRepository {
 
 	private final AssertingPartyMetadataRepository metadata =
-            OpenSamlAssertingPartyMetadataRepository
+            OpenSaml5AssertingPartyMetadataRepository
                 .fromTrustedMetadataLocation("https://idp.example.org/metadata").build();
 
 	@Override
@@ -93,7 +93,7 @@ Kotlin::
 class RefreshableRelyingPartyRegistrationRepository : IterableRelyingPartyRegistrationRepository {
 
     private val metadata: AssertingPartyMetadataRepository =
-        OpenSamlAssertingPartyMetadataRepository.fromTrustedMetadataLocation(
+        OpenSaml5AssertingPartyMetadataRepository.fromTrustedMetadataLocation(
             "https://idp.example.org/metadata").build()
 
     fun findByRegistrationId(registrationId:String?): RelyingPartyRegistration {
@@ -132,7 +132,7 @@ Java::
 +
 [source,java,role="primary"]
 ----
-OpenSamlAssertingPartyMetadataRepository.withMetadataLocation("https://idp.example.org/metadata")
+OpenSaml5AssertingPartyMetadataRepository.withMetadataLocation("https://idp.example.org/metadata")
     .verificationCredentials((c) -> c.add(myVerificationCredential))
     .build();
 ----
@@ -141,7 +141,7 @@ Kotlin::
 +
 [source,kotlin,role="secondary"]
 ----
-OpenSamlAssertingPartyMetadataRepository.withMetadataLocation("https://idp.example.org/metadata")
+OpenSaml5AssertingPartyMetadataRepository.withMetadataLocation("https://idp.example.org/metadata")
     .verificationCredentials({ c : Collection<Saml2X509Credential> ->
         c.add(myVerificationCredential) })
     .build()

gradle.properties

@@ -14,8 +14,8 @@
 # limitations under the License.
 #
 springBootVersion=3.3.3
-version=6.5.2-SNAPSHOT
-samplesBranch=main
+version=6.5.2
+samplesBranch=6.5.x
 org.gradle.jvmargs=-Xmx3g -XX:+HeapDumpOnOutOfMemoryError
 org.gradle.parallel=true
 org.gradle.caching=true

gradle/libs.versions.toml

@@ -1,11 +1,11 @@
 [versions]
 com-squareup-okhttp3 = "3.14.9"
 io-rsocket = "1.1.5"
-io-spring-javaformat = "0.0.46"
+io-spring-javaformat = "0.0.47"
 io-spring-nohttp = "0.0.11"
 jakarta-websocket = "2.2.0"
 org-apache-directory-server = "1.5.5"
-org-apache-maven-resolver = "1.9.23"
+org-apache-maven-resolver = "1.9.24"
 org-aspectj = "1.9.24"
 org-bouncycastle = "1.80"
 org-eclipse-jetty = "11.0.25"
@@ -14,7 +14,7 @@ org-jetbrains-kotlinx = "1.10.2"
 org-mockito = "5.17.0"
 org-opensaml = "4.3.2"
 org-opensaml5 = "5.1.2"
-org-springframework = "6.2.7"
+org-springframework = "6.2.8"
 
 [libraries]
 ch-qos-logback-logback-classic = "ch.qos.logback:logback-classic:1.5.18"
@@ -30,7 +30,7 @@ com-unboundid-unboundid-ldapsdk7 = "com.unboundid:unboundid-ldapsdk:7.0.1"
 commons-collections = "commons-collections:commons-collections:3.2.2"
 io-micrometer-context-propagation = "io.micrometer:context-propagation:1.1.3"
 io-micrometer-micrometer-observation = "io.micrometer:micrometer-observation:1.14.8"
-io-mockk = "io.mockk:mockk:1.14.2"
+io-mockk = "io.mockk:mockk:1.14.4"
 io-projectreactor-reactor-bom = "io.projectreactor:reactor-bom:2023.0.19"
 io-rsocket-rsocket-bom = { module = "io.rsocket:rsocket-bom", version.ref = "io-rsocket" }
 io-spring-javaformat-spring-javaformat-checkstyle = { module = "io.spring.javaformat:spring-javaformat-checkstyle", version.ref = "io-spring-javaformat" }
@@ -71,7 +71,7 @@ org-bouncycastle-bcprov-jdk15on = { module = "org.bouncycastle:bcprov-jdk18on",
 org-eclipse-jetty-jetty-server = { module = "org.eclipse.jetty:jetty-server", version.ref = "org-eclipse-jetty" }
 org-eclipse-jetty-jetty-servlet = { module = "org.eclipse.jetty:jetty-servlet", version.ref = "org-eclipse-jetty" }
 org-hamcrest = "org.hamcrest:hamcrest:2.2"
-org-hibernate-orm-hibernate-core = "org.hibernate.orm:hibernate-core:6.6.17.Final"
+org-hibernate-orm-hibernate-core = "org.hibernate.orm:hibernate-core:6.6.20.Final"
 org-hsqldb = "org.hsqldb:hsqldb:2.7.4"
 org-jetbrains-kotlin-kotlin-bom = { module = "org.jetbrains.kotlin:kotlin-bom", version.ref = "org-jetbrains-kotlin" }
 org-jetbrains-kotlin-kotlin-gradle-plugin = "org.jetbrains.kotlin:kotlin-gradle-plugin:1.9.25"
@@ -89,8 +89,8 @@ org-seleniumhq-selenium-selenium-support = "org.seleniumhq.selenium:selenium-sup
 org-skyscreamer-jsonassert = "org.skyscreamer:jsonassert:1.5.3"
 org-slf4j-log4j-over-slf4j = "org.slf4j:log4j-over-slf4j:1.7.36"
 org-slf4j-slf4j-api = "org.slf4j:slf4j-api:2.0.17"
-org-springframework-data-spring-data-bom = "org.springframework.data:spring-data-bom:2024.1.6"
-org-springframework-ldap-spring-ldap-core = "org.springframework.ldap:spring-ldap-core:3.2.12"
+org-springframework-data-spring-data-bom = "org.springframework.data:spring-data-bom:2024.1.7"
+org-springframework-ldap-spring-ldap-core = "org.springframework.ldap:spring-ldap-core:3.2.13"
 org-springframework-spring-framework-bom = { module = "org.springframework:spring-framework-bom", version.ref = "org-springframework" }
 org-synchronoss-cloud-nio-multipart-parser = "org.synchronoss.cloud:nio-multipart-parser:1.1.0"
 
@@ -108,7 +108,7 @@ org-jfrog-buildinfo-build-info-extractor-gradle = "org.jfrog.buildinfo:build-inf
 org-sonarsource-scanner-gradle-sonarqube-gradle-plugin = "org.sonarsource.scanner.gradle:sonarqube-gradle-plugin:2.8.0.1969"
 org-instancio-instancio-junit = "org.instancio:instancio-junit:3.7.1"
 
-webauthn4j-core = 'com.webauthn4j:webauthn4j-core:0.29.3.RELEASE'
+webauthn4j-core = 'com.webauthn4j:webauthn4j-core:0.29.4.RELEASE'
 
 [plugins]
 

web/src/main/java/org/springframework/security/web/servlet/util/matcher/PathPatternRequestMatcher.java

@@ -38,8 +38,8 @@ import org.springframework.web.util.pattern.PathPatternParser;
  * (that is, it should exclude any context path).
  *
  * <p>
- * You can provide the servlet path in {@link PathPatternRequestMatcher#servletPath} and
- * reuse for multiple matchers.
+ * You can provide the servlet path in {@link PathPatternRequestMatcher.Builder#basePath}
+ * and reuse for multiple matchers.
  *
  * <p>
  * Note that the {@link org.springframework.web.servlet.HandlerMapping} that contains the
@@ -55,14 +55,12 @@ public final class PathPatternRequestMatcher implements RequestMatcher {
 
 	private final PathPattern pattern;
 
-	private RequestMatcher servletPath = AnyRequestMatcher.INSTANCE;
-
 	private RequestMatcher method = AnyRequestMatcher.INSTANCE;
 
 	/**
 	 * Creates a {@link PathPatternRequestMatcher} that uses the provided {@code pattern}.
 	 * <p>
-	 * The {@code pattern} should be relative to the servlet path
+	 * The {@code pattern} should be relative to the context path
 	 * </p>
 	 * @param pattern the pattern used to match
 	 */
@@ -102,9 +100,6 @@ public final class PathPatternRequestMatcher implements RequestMatcher {
 	 */
 	@Override
 	public MatchResult matcher(HttpServletRequest request) {
-		if (!this.servletPath.matches(request)) {
-			return MatchResult.notMatch();
-		}
 		if (!this.method.matches(request)) {
 			return MatchResult.notMatch();
 		}
@@ -138,7 +133,7 @@ public final class PathPatternRequestMatcher implements RequestMatcher {
 		if (!(o instanceof PathPatternRequestMatcher that)) {
 			return false;
 		}
-		return Objects.equals(this.pattern, that.pattern);
+		return Objects.equals(this.pattern, that.pattern) && Objects.equals(this.method, that.method);
 	}
 
 	/**
@@ -146,7 +141,7 @@ public final class PathPatternRequestMatcher implements RequestMatcher {
 	 */
 	@Override
 	public int hashCode() {
-		return Objects.hash(this.pattern);
+		return Objects.hash(this.pattern, this.method);
 	}
 
 	/**
@@ -232,8 +227,9 @@ public final class PathPatternRequestMatcher implements RequestMatcher {
 		 * also be followed by {@code /**} to signify all URIs under a given path.
 		 *
 		 * <p>
-		 * These must be specified relative to any servlet path prefix (meaning you should
-		 * exclude the context path and any servlet path prefix in stating your pattern).
+		 * These must be specified relative to any context path prefix. A
+		 * {@link #basePath} may be specified to reuse a common prefix, for example a
+		 * servlet path.
 		 *
 		 * <p>
 		 * The following are valid patterns and their meaning
@@ -266,8 +262,9 @@ public final class PathPatternRequestMatcher implements RequestMatcher {
 		 * also be followed by {@code /**} to signify all URIs under a given path.
 		 *
 		 * <p>
-		 * These must be specified relative to any servlet path prefix (meaning you should
-		 * exclude the context path and any servlet path prefix in stating your pattern).
+		 * These must be specified relative to any context path prefix. A
+		 * {@link #basePath} may be specified to reuse a common prefix, for example a
+		 * servlet path.
 		 *
 		 * <p>
 		 * The following are valid patterns and their meaning