Bump io-spring-javaformat from 0.0.47 to 0.0.48

Bumps `io-spring-javaformat` from 0.0.47 to 0.0.48.

Updates `io.spring.javaformat:spring-javaformat-checkstyle` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48)

Updates `io.spring.javaformat:spring-javaformat-gradle-plugin` from 0.0.47 to 0.0.48
- [Release notes](https://github.com/spring-io/spring-javaformat/releases)
- [Commits](https://github.com/spring-io/spring-javaformat/compare/v0.0.47...v0.0.48)

---
updated-dependencies:
- dependency-name: io.spring.javaformat:spring-javaformat-checkstyle
  dependency-version: 0.0.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
- dependency-name: io.spring.javaformat:spring-javaformat-gradle-plugin
  dependency-version: 0.0.48
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/workflows/auto-merge-dependabot.yml

@@ -4,6 +4,7 @@ on:
   pull_request:
     branches:
       - main
+      - '*.x'
       - 'docs-build'
 
 run-name: Merge Dependabot PR ${{ github.ref_name }}
@@ -13,4 +14,4 @@ jobs:
     permissions: write-all
     uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@0d3f15bb384839966a1ff5c4383731a2b747f24b # v7
     with:
-      mergeArguments: --auto --rebase
+      mergeArguments: --auto --rebase

.github/workflows/check-snapshots.yml

@@ -14,7 +14,7 @@ permissions:
 jobs:
   snapshot-test:
     name: Test Against Snapshots
-    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
     strategy:
       matrix:
         include:
@@ -31,6 +31,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
         with:
           webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/continuous-integration-workflow.yml

@@ -17,7 +17,7 @@ permissions:
 jobs:
   build:
     name: Build
-    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
     strategy:
       matrix:
         os: [ ubuntu-latest, windows-latest ]
@@ -30,7 +30,7 @@ jobs:
   deploy-artifacts:
     name: Deploy Artifacts
     needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
     with:
       should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
       default-publish-milestones-central: true
@@ -51,6 +51,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
         with:
           webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/defer-issues.yml

@@ -18,10 +18,10 @@ jobs:
       uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Compute Version
       id: compute-version
-      uses: spring-io/spring-release-actions/compute-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
     - name: Get Today's Release Version
       id: todays-release
-      uses: spring-io/spring-release-actions/get-todays-release-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      uses: spring-io/spring-release-actions/get-todays-release-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
       with:
         snapshot-version: ${{ steps.compute-version.outputs.version }}
         milestone-repository: ${{ github.repository }}
@@ -32,7 +32,7 @@ jobs:
       with:
         version: ${{ steps.todays-release.outputs.release-version }}
     - name: Schedule Next Milestone
-      uses: spring-io/spring-release-actions/schedule-milestone@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      uses: spring-io/spring-release-actions/schedule-milestone@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
       with:
         version: ${{ steps.next-version.outputs.version }}
         version-date: ${{ steps.next-version.outputs.version-date }}

.github/workflows/gradle-wrapper-upgrade-execution.yml

@@ -22,7 +22,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Set up JDK 25
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
         with:
           java-version: '25'
           distribution: 'temurin'

.github/workflows/pr-build-workflow.yml

@@ -46,6 +46,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
         with:
           webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}

.github/workflows/release-announcements-publish.yml

@@ -24,7 +24,7 @@ jobs:
     name: Publish Release Announcements
     needs: [ deploy-schema ]
     if: ${{ !github.event.repository.fork }}
-    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@d6c65d3013c0888e2c9cbae9f4beda610994776c # v1.0.16
     with:
       version: ${{ inputs.version }}
     secrets: inherit

config/src/main/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfiguration.java

@@ -32,7 +32,6 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.ImportAware;
 import org.springframework.context.annotation.Role;
 import org.springframework.core.type.AnnotationMetadata;
-import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -128,11 +127,6 @@ final class PrePostMethodSecurityConfiguration implements ImportAware, Applicati
 		this.expressionHandler.setAuthorizationManagerFactory(authorizationManagerFactory);
 	}
 
-	@Autowired(required = false)
-	void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
-		this.expressionHandler.setPermissionEvaluator(permissionEvaluator);
-	}
-
 	@Autowired(required = false)
 	void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
 		this.preFilterMethodInterceptor.setTemplateDefaults(templateDefaults);

config/src/main/java/org/springframework/security/config/web/server/ServerHttpSecurity.java

@@ -297,7 +297,6 @@ import org.springframework.web.util.pattern.PathPatternParser;
  * @author Ankur Pathak
  * @author Alexey Nesterov
  * @author Yanming Zhou
- * @author Iain Henderson
  * @since 5.0
  */
 public class ServerHttpSecurity {
@@ -4139,8 +4138,6 @@ public class ServerHttpSecurity {
 
 		private ServerAuthenticationFailureHandler authenticationFailureHandler;
 
-		private ServerAuthenticationSuccessHandler authenticationSuccessHandler;
-
 		private ServerAccessDeniedHandler accessDeniedHandler = new BearerTokenServerAccessDeniedHandler();
 
 		private ServerAuthenticationConverter bearerTokenConverter = new ServerBearerTokenAuthenticationConverter();
@@ -4189,20 +4186,6 @@ public class ServerHttpSecurity {
 			return this;
 		}
 
-		/**
-		 * Configures the {@link ServerAuthenticationSuccessHandler} to use. The default
-		 * is {@link WebFilterChainServerAuthenticationSuccessHandler}
-		 * @param authenticationSuccessHandler the
-		 * {@link ServerAuthenticationSuccessHandler} to use
-		 * @return the {@link OAuth2ClientSpec} to customize
-		 * @since 7.2
-		 */
-		public OAuth2ResourceServerSpec authenticationSuccessHandler(
-				ServerAuthenticationSuccessHandler authenticationSuccessHandler) {
-			this.authenticationSuccessHandler = authenticationSuccessHandler;
-			return this;
-		}
-
 		/**
 		 * Configures the {@link ServerAuthenticationConverter} to use for requests
 		 * authenticating with
@@ -4271,7 +4254,6 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(this.authenticationManagerResolver);
 				oauth2.setServerAuthenticationConverter(this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
-				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 			else if (this.jwt != null) {
@@ -4331,13 +4313,6 @@ public class ServerHttpSecurity {
 			return new ServerAuthenticationEntryPointFailureHandler(this.entryPoint);
 		}
 
-		private ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
-			if (this.authenticationSuccessHandler != null) {
-				return this.authenticationSuccessHandler;
-			}
-			return new WebFilterChainServerAuthenticationSuccessHandler();
-		}
-
 		/**
 		 * Configures JWT Resource Server Support
 		 */
@@ -4412,7 +4387,6 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(authenticationManager);
 				oauth2.setServerAuthenticationConverter(OAuth2ResourceServerSpec.this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
-				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 
@@ -4545,7 +4519,6 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(authenticationManager);
 				oauth2.setServerAuthenticationConverter(OAuth2ResourceServerSpec.this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
-				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 

config/src/main/kotlin/org/springframework/security/config/web/server/ServerOAuth2ResourceServerDsl.kt

@@ -20,7 +20,6 @@ import org.springframework.security.authentication.ReactiveAuthenticationManager
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint
 import org.springframework.security.web.server.authentication.ServerAuthenticationConverter
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler
-import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler
 import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler
 import org.springframework.web.server.ServerWebExchange
 
@@ -36,8 +35,6 @@ import org.springframework.web.server.ServerWebExchange
  * @property bearerTokenConverter the [ServerAuthenticationConverter] to use for requests authenticating with
  * Bearer Tokens.
  * @property authenticationManagerResolver the [ReactiveAuthenticationManagerResolver] to use.
- * @property authenticationSuccessHandler the [ServerAuthenticationSuccessHandler] to use after
- * authentication success.
  */
 @ServerSecurityMarker
 class ServerOAuth2ResourceServerDsl {
@@ -46,7 +43,6 @@ class ServerOAuth2ResourceServerDsl {
     var authenticationEntryPoint: ServerAuthenticationEntryPoint? = null
     var bearerTokenConverter: ServerAuthenticationConverter? = null
     var authenticationManagerResolver: ReactiveAuthenticationManagerResolver<ServerWebExchange>? = null
-    var authenticationSuccessHandler: ServerAuthenticationSuccessHandler? = null
 
     private var jwt: ((ServerHttpSecurity.OAuth2ResourceServerSpec.JwtSpec) -> Unit)? = null
     private var opaqueToken: ((ServerHttpSecurity.OAuth2ResourceServerSpec.OpaqueTokenSpec) -> Unit)? = null
@@ -119,7 +115,6 @@ class ServerOAuth2ResourceServerDsl {
             authenticationEntryPoint?.also { oauth2ResourceServer.authenticationEntryPoint(authenticationEntryPoint) }
             bearerTokenConverter?.also { oauth2ResourceServer.bearerTokenConverter(bearerTokenConverter) }
             authenticationManagerResolver?.also { oauth2ResourceServer.authenticationManagerResolver(authenticationManagerResolver!!) }
-            authenticationSuccessHandler?.also { oauth2ResourceServer.authenticationSuccessHandler(authenticationSuccessHandler) }
             jwt?.also { oauth2ResourceServer.jwt(jwt) }
             opaqueToken?.also { oauth2ResourceServer.opaqueToken(opaqueToken) }
         }

config/src/test/java/org/springframework/security/config/annotation/method/configuration/PrePostMethodSecurityConfigurationTests.java

@@ -1527,13 +1527,13 @@ public class PrePostMethodSecurityConfigurationTests {
 
 	}
 
-	@Configuration
 	@EnableMethodSecurity
 	static class CustomPermissionEvaluatorConfig {
 
 		@Bean
-		PermissionEvaluator permissionEvaluator() {
-			return new PermissionEvaluator() {
+		MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
+			DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
+			expressionHandler.setPermissionEvaluator(new PermissionEvaluator() {
 				@Override
 				public boolean hasPermission(Authentication authentication, Object targetDomainObject,
 						Object permission) {
@@ -1545,7 +1545,8 @@ public class PrePostMethodSecurityConfigurationTests {
 						Object permission) {
 					throw new UnsupportedOperationException();
 				}
-			};
+			});
+			return expressionHandler;
 		}
 
 	}

config/src/test/java/org/springframework/security/config/web/server/OAuth2ResourceServerSpecTests.java

@@ -73,11 +73,9 @@ import org.springframework.security.oauth2.server.resource.authentication.Reacti
 import org.springframework.security.oauth2.server.resource.authentication.ReactiveJwtAuthenticationConverterAdapter;
 import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenAuthenticationConverter;
 import org.springframework.security.web.server.SecurityWebFilterChain;
-import org.springframework.security.web.server.WebFilterExchange;
 import org.springframework.security.web.server.authentication.HttpStatusServerEntryPoint;
 import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler;
-import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
 import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -373,79 +371,6 @@ public class OAuth2ResourceServerSpecTests {
 		verify(handler).onAuthenticationFailure(any(), any());
 	}
 
-	@Test
-	public void getWhenUsingCustomAuthenticationSuccessHandlerThenUsesIsAccordingly() {
-		this.spring.register(CustomAuthenticationSuccessHandlerAuthenticationManagerResolverConfig.class).autowire();
-		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
-			.getBean(ServerAuthenticationSuccessHandler.class);
-		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
-			.getBean(ReactiveAuthenticationManager.class);
-		given(authenticationManager.authenticate(any()))
-			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
-		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
-			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
-			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
-		});
-		// @formatter:off
-		this.client.get()
-				.headers((headers) -> headers.setBearerAuth(this.messageReadToken))
-				.exchange()
-				.expectStatus().isUnauthorized();
-		// @formatter:on
-		verify(handler).onAuthenticationSuccess(any(), any());
-	}
-
-	@Test
-	public void getWhenUsingCustomAuthenticationSuccessHandlerWithJwtThenUsesIsAccordingly() {
-		this.spring.register(CustomAuthenticationSuccessHandlerJwtConfig.class).autowire();
-		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
-			.getBean(ServerAuthenticationSuccessHandler.class);
-		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
-			.getBean(ReactiveAuthenticationManager.class);
-		given(authenticationManager.authenticate(any()))
-			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
-		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
-			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
-			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
-		});
-		// @formatter:off
-		this.client.get()
-				.headers((headers) -> headers.setBearerAuth(this.messageReadToken))
-				.exchange()
-				.expectStatus().isUnauthorized();
-		// @formatter:on
-		verify(handler).onAuthenticationSuccess(any(), any());
-	}
-
-	@Test
-	public void getWhenUsingCustomAuthenticationSuccessHandlerWIthOpaqueTokenThenUsesIsAccordingly() {
-		this.spring.register(CustomAuthenticationSuccessHandlerOpaqueTokenConfig.class, RootController.class)
-			.autowire();
-		this.spring.getContext()
-			.getBean(MockWebServer.class)
-			.setDispatcher(requiresAuth(this.clientId, this.clientSecret, this.active));
-		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
-			.getBean(ServerAuthenticationSuccessHandler.class);
-		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
-			.getBean(ReactiveAuthenticationManager.class);
-		given(authenticationManager.authenticate(any()))
-			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
-		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
-			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
-			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
-		});
-		// @formatter:off
-		this.client.get()
-				.headers((headers) -> headers
-						.setBearerAuth(this.messageReadToken)
-				)
-				.exchange()
-				.expectStatus().isOk();
-		// @formatter:on
-
-		verify(handler).onAuthenticationSuccess(any(), any());
-	}
-
 	@Test
 	public void postWhenSignedThenReturnsOk() {
 		this.spring.register(PublicKeyConfig.class, RootController.class).autowire();
@@ -1025,111 +950,6 @@ public class OAuth2ResourceServerSpecTests {
 
 	}
 
-	@Configuration
-	@EnableWebFlux
-	@EnableWebFluxSecurity
-	static class CustomAuthenticationSuccessHandlerAuthenticationManagerResolverConfig {
-
-		@Bean
-		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
-			// @formatter:off
-			http
-					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
-					.oauth2ResourceServer((oauth2) -> oauth2
-							.authenticationSuccessHandler(authenticationSuccessHandler())
-							.authenticationManagerResolver((exchange) -> Mono.just(authenticationManager()))
-					);
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		ReactiveAuthenticationManager authenticationManager() {
-			return mock(ReactiveAuthenticationManager.class);
-		}
-
-		@Bean
-		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
-			return mock(ServerAuthenticationSuccessHandler.class);
-		}
-
-	}
-
-	@Configuration
-	@EnableWebFlux
-	@EnableWebFluxSecurity
-	static class CustomAuthenticationSuccessHandlerJwtConfig {
-
-		@Bean
-		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
-			// @formatter:off
-			http
-					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
-					.oauth2ResourceServer((oauth2) -> oauth2
-							.authenticationSuccessHandler(authenticationSuccessHandler())
-							.jwt((jwt) -> jwt.authenticationManager(authenticationManager()))
-					);
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		ReactiveAuthenticationManager authenticationManager() {
-			return mock(ReactiveAuthenticationManager.class);
-		}
-
-		@Bean
-		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
-			return mock(ServerAuthenticationSuccessHandler.class);
-		}
-
-	}
-
-	@Configuration
-	@EnableWebFlux
-	@EnableWebFluxSecurity
-	static class CustomAuthenticationSuccessHandlerOpaqueTokenConfig {
-
-		private MockWebServer mockWebServer = new MockWebServer();
-
-		@Bean
-		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
-			String introspectionUri = mockWebServer().url("/introspect").toString();
-			// @formatter:off
-			http
-					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
-					.oauth2ResourceServer((oauth2) -> oauth2
-							.authenticationSuccessHandler(authenticationSuccessHandler())
-							.opaqueToken((opaqueToken) -> opaqueToken
-									.introspectionUri(introspectionUri)
-									.introspectionClientCredentials("client", "secret"))
-					);
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		ReactiveAuthenticationManager authenticationManager() {
-			return mock(ReactiveAuthenticationManager.class);
-		}
-
-		@Bean
-		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
-			return mock(ServerAuthenticationSuccessHandler.class);
-		}
-
-		@Bean
-		MockWebServer mockWebServer() {
-			return this.mockWebServer;
-		}
-
-		@PreDestroy
-		void shutdown() throws IOException {
-			this.mockWebServer.shutdown();
-		}
-
-	}
-
 	@EnableWebFlux
 	@EnableWebFluxSecurity
 	static class CustomBearerTokenServerAuthenticationConverter {

config/src/test/kotlin/org/springframework/security/config/web/server/ServerOAuth2ResourceServerDslTests.kt

@@ -17,7 +17,6 @@
 package org.springframework.security.config.web.server
 
 import io.mockk.every
-import io.mockk.mockk
 import io.mockk.mockkObject
 import io.mockk.verify
 import org.junit.jupiter.api.Test
@@ -38,7 +37,6 @@ import org.springframework.security.web.server.SecurityWebFilterChain
 import org.springframework.security.web.server.WebFilterExchange
 import org.springframework.security.web.server.authentication.HttpStatusServerEntryPoint
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler
-import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler
 import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler
 import org.springframework.test.web.reactive.server.WebTestClient
 import org.springframework.web.reactive.config.EnableWebFlux
@@ -185,46 +183,6 @@ class ServerOAuth2ResourceServerDslTests {
 
     }
 
-    @Test
-    fun `request when custom authentication success handler then success handler used`() {
-        this.spring.register(AuthenticationSuccessHandlerConfig::class.java).autowire()
-        every {
-            AuthenticationSuccessHandlerConfig.SUCCESS_HANDLER.onAuthenticationSuccess(any(), any())
-        } returns Mono.empty()
-
-        this.client.get()
-            .uri("/")
-            .headers { it.setBearerAuth(validJwt) }
-            .exchange()
-
-        verify(exactly = 1) { AuthenticationSuccessHandlerConfig.SUCCESS_HANDLER.onAuthenticationSuccess(any(), any()) }
-    }
-
-    @Configuration
-    @EnableWebFluxSecurity
-    @EnableWebFlux
-    open class AuthenticationSuccessHandlerConfig {
-
-        companion object {
-            val SUCCESS_HANDLER: ServerAuthenticationSuccessHandler = mockk()
-        }
-
-        @Bean
-        open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-            return http {
-                authorizeExchange {
-                    authorize(anyExchange, authenticated)
-                }
-                oauth2ResourceServer {
-                    authenticationSuccessHandler = SUCCESS_HANDLER
-                    jwt {
-                        publicKey = publicKey()
-                    }
-                }
-            }
-        }
-    }
-
     @Test
     fun `request when custom bearer token converter configured then custom converter used`() {
         this.spring.register(BearerTokenConverterConfig::class.java).autowire()

core/src/main/java/org/springframework/security/authentication/ProviderManager.java

@@ -34,6 +34,7 @@ import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.CredentialsContainer;
 import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.util.Assert;
+import org.springframework.util.CollectionUtils;
 
 /**
  * Iterates an {@link Authentication} request through a list of
@@ -137,7 +138,8 @@ public class ProviderManager implements AuthenticationManager, MessageSourceAwar
 	private void checkState() {
 		Assert.isTrue(this.parent != null || !this.providers.isEmpty(),
 				"A parent AuthenticationManager or a list of AuthenticationProviders is required");
-		Assert.noNullElements(this.providers, "providers list cannot contain null values");
+		Assert.isTrue(!CollectionUtils.contains(this.providers.iterator(), null),
+				"providers list cannot contain null values");
 	}
 
 	/**

core/src/main/java/org/springframework/security/authorization/method/PostFilterAuthorizationMethodInterceptor.java

@@ -123,7 +123,7 @@ public final class PostFilterAuthorizationMethodInterceptor implements Authoriza
 	/**
 	 * Filter a {@code returnedObject} using the {@link PostFilter} annotation that the
 	 * {@link MethodInvocation} specifies.
-	 * @param mi the {@link MethodInvocation} to check
+	 * @param mi the {@link MethodInvocation} to check check
 	 * @return filtered {@code returnedObject}
 	 */
 	@Override

core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextCallable.java

@@ -131,7 +131,7 @@ public final class DelegatingSecurityContextCallable<V> implements Callable<V> {
 	/**
 	 * Creates a {@link DelegatingSecurityContextCallable} and with the given
 	 * {@link Callable} and {@link SecurityContext}, but if the securityContext is null
-	 * will default to the current {@link SecurityContext} on the
+	 * will defaults to the current {@link SecurityContext} on the
 	 * {@link SecurityContextHolder}
 	 * @param delegate the delegate {@link DelegatingSecurityContextCallable} to run with
 	 * the specified {@link SecurityContext}. Cannot be null.

core/src/main/java/org/springframework/security/concurrent/DelegatingSecurityContextRunnable.java

@@ -47,7 +47,7 @@ public final class DelegatingSecurityContextRunnable implements Runnable {
 		.getContextHolderStrategy();
 
 	/**
-	 * The {@link SecurityContext} that the delegate {@link Runnable} will be run as.
+	 * The {@link SecurityContext} that the delegate {@link Runnable} will be ran as.
 	 */
 	private SecurityContext delegateSecurityContext;
 

core/src/main/java/org/springframework/security/core/token/TokenService.java

@@ -35,7 +35,7 @@ import org.jspecify.annotations.Nullable;
  * building block for more sophisticated token-based solutions. For example,
  * authentication systems that depend on stateless session keys. These could, for
  * instance, place the username inside the user-specified extended information associated
- * with the key. It is important to recognise that we do not intend for this interface to
+ * with the key). It is important to recognise that we do not intend for this interface to
  * be expanded to provide such capabilities directly.
  * </p>
  *

core/src/main/java/org/springframework/security/core/userdetails/User.java

@@ -323,7 +323,7 @@ public class User implements UserDetails, CredentialsContainer {
 
 	/**
 	 * Builds the user to be added. At minimum the username, password, and authorities
-	 * should be provided. The remaining attributes have reasonable defaults.
+	 * should provided. The remaining attributes have reasonable defaults.
 	 */
 	public static final class UserBuilder {
 

core/src/main/java/org/springframework/security/core/userdetails/UserDetailsService.java

@@ -38,7 +38,7 @@ public interface UserDetailsService {
 	 * may possibly be case sensitive, or case insensitive depending on how the
 	 * implementation instance is configured. In this case, the <code>UserDetails</code>
 	 * object that comes back may have a username that is of a different case than what
-	 * was actually requested.
+	 * was actually requested..
 	 * @param username the username identifying the user whose data is required.
 	 * @return a fully populated user record (never <code>null</code>)
 	 * @throws UsernameNotFoundException if the user could not be found or the user has no

core/src/main/java/org/springframework/security/provisioning/package-info.java

@@ -16,7 +16,7 @@
 
 /**
  * Contains simple user and authority group account provisioning interfaces together with
- * a JDBC-based implementation.
+ * a a JDBC-based implementation.
  */
 @NullMarked
 package org.springframework.security.provisioning;

docs/modules/ROOT/pages/reactive/authentication/onetimetoken.adoc

@@ -54,13 +54,138 @@ Therefore, a custom javadoc:org.springframework.security.web.server.authenticati
 One of the most common delivery strategies is a Magic Link, via e-mail, SMS, etc.
 In the following example, we are going to create a magic link and sent it to the user's email.
 
-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.One-Time Token Login Configuration
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+}
+
+import org.springframework.mail.SimpleMailMessage;
+import org.springframework.mail.javamail.JavaMailSender;
+
+@Component <1>
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+
+    private final MailSender mailSender;
+
+    private final ServerOneTimeTokenGenerationSuccessHandler redirectHandler = new ServerRedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");
+
+    // constructor omitted
+
+    @Override
+    public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
+        return Mono.just(exchange.getRequest())
+				.map((request) ->
+					UriComponentsBuilder.fromUri(request.getURI())
+						.replacePath(request.getPath().contextPath().value())
+						.replaceQuery(null)
+						.fragment(null)
+						.path("/login/ott")
+						.queryParam("token", oneTimeToken.getTokenValue())
+						.toUriString() <2>
+					)
+			.flatMap((uri) -> this.mailSender.send(getUserEmail(oneTimeToken.getUsername()), <3>
+					"Use the following link to sign in into the application: " + magicLink)) <4>
+			.then(this.redirectHandler.handle(exchange, oneTimeToken)); <5>
+    }
+
+    private String getUserEmail() {
+        // ...
+    }
+
+}
+
+@Controller
+class PageController {
+
+    @GetMapping("/ott/sent")
+    String ottSent() {
+        return "my-template";
+    }
+
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                authorizeExchange {
+                    authorize(anyExchange, authenticated)
+                 }
+                 oneTimeTokenLogin { }
+             }
+         }
+
+}
+
+@Component (1)
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+
+    private val redirectStrategy: ServerRedirectStrategy = DefaultServerRedirectStrategy()
+
+    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
+        val builder = UriComponentsBuilder.fromUri(exchange.request.uri)
+            .replacePath(null)
+            .replaceQuery(null)
+            .fragment(null)
+            .path("/login/ott")
+            .queryParam("token", oneTimeToken.getTokenValue()) (2)
+        val magicLink = builder.toUriString()
+        builder.replacePath(null)
+            .replaceQuery(null)
+            .path("/ott/sent")
+        val redirectLink = builder.toUriString()
+        return this.mailSender.send(
+            getUserEmail(oneTimeToken.getUsername()), (3)
+            "Use the following link to sign in into the application: $magicLink") (4)
+        .then(this.redirectStrategy.sendRedirect(exchange, URI.create(redirectLink))) (5)
+    }
+
+        private String getUserEmail() {
+            // ...
+        }
+}
+
+@Controller
+class PageController {
+
+    @GetMapping("/ott/sent")
+    fun ottSent(): String {
+        return "my-template"
+    }
+}
+
+----
+======
+
 <1> Make the `MagicLinkOneTimeTokenGenerationSuccessHandler` a Spring bean
 <2> Create a login processing URL with the `token` as a query param
 <3> Retrieve the user's email based on the username
 <4> Use the `MailSender` API to send the email to the user with the magic link
-<5> Use the `ServerOneTimeTokenGenerationSuccessHandler` to perform a redirect to your desired URL
+<5> Use the `ServerRedirectStrategy` to perform a redirect to your desired URL
 
 The email content will look similar to:
 
@@ -72,10 +197,65 @@ The default submit page will detect that the URL has the `token` query param and
 == Changing the One-Time Token Generate URL
 
 By default, the javadoc:org.springframework.security.web.server.authentication.ott.GenerateOneTimeTokenWebFilter[] listens to `POST /ott/generate` requests.
-That URL can be changed by using the `tokenGeneratingUrl(String)` DSL method:
+That URL can be changed by using the `generateTokenUrl(String)` DSL method:
 
-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Changing the Generate URL
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .generateTokenUrl("/ott/my-generate-url")
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                 // ...
+                 formLogin { }
+                 oneTimeTokenLogin {
+                    generateTokenUrl = "/ott/my-generate-url"
+                 }
+             }
+         }
+
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======
 
 [[changing-submit-page-url]]
 == Changing the Default Submit Page URL
@@ -83,17 +263,151 @@ include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent
 The default One-Time Token submit page is generated by the javadoc:org.springframework.security.web.server.ui.OneTimeTokenSubmitPageGeneratingWebFilter[] and listens to `GET /login/ott`.
 The URL can also be changed, like so:
 
-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Configuring the Default Submit Page URL
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .submitPageUrl("/ott/submit")
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                 // ...
+                 formLogin { }
+                 oneTimeTokenLogin {
+                    submitPageUrl = "/ott/submit"
+                 }
+             }
+         }
+
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======
 
 [[disabling-default-submit-page]]
 == Disabling the Default Submit Page
 
 If you want to use your own One-Time Token submit page, you can disable the default page and then provide your own endpoint.
 
-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
-include-code::./MyController[tag=snippet,indent=0]
+.Disabling the Default Submit Page
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            .authorizeExchange((authorize) -> authorize
+                .pathMatchers("/my-ott-submit").permitAll()
+                .anyExchange().authenticated()
+            )
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .showDefaultSubmitPage(false)
+            );
+        return http.build();
+    }
+
+}
+
+@Controller
+public class MyController {
+
+    @GetMapping("/my-ott-submit")
+    public String ottSubmitPage() {
+        return "my-ott-submit";
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                authorizeExchange {
+                    authorize(pathMatchers("/my-ott-submit"), permitAll)
+                    authorize(anyExchange, authenticated)
+                 }
+                 .formLogin { }
+                 oneTimeTokenLogin {
+                    showDefaultSubmitPage = false
+                 }
+             }
+         }
+
+}
+
+@Controller
+class MyController {
+
+    @GetMapping("/my-ott-submit")
+    fun ottSubmitPage(): String {
+        return "my-ott-submit"
+    }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======
 
 [[customize-generate-consume-token]]
 == Customize How to Generate and Consume One-Time Tokens
@@ -111,21 +425,160 @@ Some of the most common reasons to customize the `ReactiveOneTimeTokenService` a
 There are two options to customize the `ReactiveOneTimeTokenService`.
 One option is to provide it as a bean, so it can be automatically be picked-up by the `oneTimeTokenLogin()` DSL:
 
-include-code::./OneTimeTokenServiceBeanSecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Passing the ReactiveOneTimeTokenService as a Bean
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+    @Bean
+    public ReactiveOneTimeTokenService oneTimeTokenService() {
+        return new MyCustomReactiveOneTimeTokenService();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                 //..
+                 .formLogin { }
+                 oneTimeTokenLogin { }
+             }
+         }
+
+         @Bean
+         open fun oneTimeTokenService():ReactiveOneTimeTokenService {
+             return MyCustomReactiveOneTimeTokenService();
+         }
+
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======
 
 The second option is to pass the `ReactiveOneTimeTokenService` instance to the DSL, which is useful if there are multiple ``SecurityWebFilterChain``s and a different ``ReactiveOneTimeTokenService``s is needed for each of them.
 
-include-code::./OneTimeTokenServiceDSLSecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Passing the ReactiveOneTimeTokenService using the DSL
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .oneTimeTokenService(new MyCustomReactiveOneTimeTokenService())
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                 //..
+                 .formLogin { }
+                 oneTimeTokenLogin {
+                    oneTimeTokenService = MyCustomReactiveOneTimeTokenService()
+                 }
+             }
+         }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======
 
 [[customize-generate-token-request]]
 == Customize GenerateOneTimeTokenRequest Instance
 There are a number of reasons that you may want to adjust an GenerateOneTimeTokenRequest. For example, you may want expiresIn to be set to 10 mins, which Spring Security sets to 5 mins by default.
 
-You can customize elements of GenerateOneTimeTokenRequest by publishing an ServerGenerateOneTimeTokenRequestResolver as a `@Bean`, like so:
+You can customize elements of GenerateOneTimeTokenRequest by publishing an ServerGenerateOneTimeTokenRequestResolver as a @Bean, like so:
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Bean
+ServerGenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
+    DefaultServerGenerateOneTimeTokenRequestResolver resolver = new DefaultServerGenerateOneTimeTokenRequestResolver();
+    resolver.setExpiresIn(Duration.ofSeconds(600));
+    return resolver;
+}
+----
 
-include-code::./SecurityConfig[tag=config,indent=0]
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun generateOneTimeTokenRequestResolver() : ServerGenerateOneTimeTokenRequestResolver {
+    return DefaultServerGenerateOneTimeTokenRequestResolver().apply {
+        this.setExpiresIn(Duration.ofMinutes(10))
+    }
+}
+----
+======
 
 [[validating-account-status]]
 == Validating Account Status

docs/modules/ROOT/pages/servlet/authentication/onetimetoken.adoc

@@ -54,12 +54,133 @@ Therefore, a custom javadoc:org.springframework.security.web.authentication.ott.
 One of the most common delivery strategies is a Magic Link, via e-mail, SMS, etc.
 In the following example, we are going to create a magic link and sent it to the user's email.
 
-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.One-Time Token Login Configuration
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+}
+
+import org.springframework.mail.SimpleMailMessage;
+import org.springframework.mail.javamail.JavaMailSender;
+
+@Component <1>
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+
+    private final MailSender mailSender;
+
+    private final OneTimeTokenGenerationSuccessHandler redirectHandler = new RedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");
+
+    // constructor omitted
+
+    @Override
+    public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException {
+        UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(request.getRequestURL().toString())
+                .replacePath(request.getContextPath())
+                .replaceQuery(null)
+                .fragment(null)
+                .path("/login/ott")
+                .queryParam("token", oneTimeToken.getTokenValue()); <2>
+        String magicLink = builder.toUriString();
+        String email = getUserEmail(oneTimeToken.getUsername()); <3>
+        this.mailSender.send(email, "Your Spring Security One Time Token", "Use the following link to sign in into the application: " + magicLink); <4>
+        this.redirectHandler.handle(request, response, oneTimeToken); <5>
+    }
+
+    private String getUserEmail() {
+        // ...
+    }
+
+}
+
+@Controller
+class PageController {
+
+    @GetMapping("/ott/sent")
+    String ottSent() {
+        return "my-template";
+    }
+
+}
+
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+        @Bean
+        open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+            http{
+                formLogin {}
+                oneTimeTokenLogin {  }
+            }
+            return http.build()
+        }
+}
+
+import org.springframework.mail.SimpleMailMessage;
+import org.springframework.mail.javamail.JavaMailSender;
+
+@Component (1)
+class MagicLinkOneTimeTokenGenerationSuccessHandler(
+    private val mailSender: MailSender,
+    private val redirectHandler: OneTimeTokenGenerationSuccessHandler = RedirectOneTimeTokenGenerationSuccessHandler("/ott/sent")
+) : OneTimeTokenGenerationSuccessHandler {
+
+    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
+        val builder = UriComponentsBuilder.fromUriString(request.getRequestURL().toString())
+            .replacePath(request.contextPath)
+            .replaceQuery(null)
+            .fragment(null)
+            .path("/login/ott")
+            .queryParam("token", oneTimeToken.getTokenValue()) (2)
+        val magicLink = builder.toUriString()
+        val email = getUserEmail(oneTimeToken.getUsername()) (3)
+        this.mailSender.send(email, "Your Spring Security One Time Token", "Use the following link to sign in into the application: $magicLink")(4)
+        this.redirectHandler.handle(request, response, oneTimeToken) (5)
+    }
+
+    private fun getUserEmail(): String {
+        // ...
+    }
+}
+
+@Controller
+class PageController {
+
+    @GetMapping("/ott/sent")
+    fun ottSent(): String {
+        return "my-template"
+    }
+}
+
+----
+======
+
 <1> Make the `MagicLinkOneTimeTokenGenerationSuccessHandler` a Spring bean
 <2> Create a login processing URL with the `token` as a query param
 <3> Retrieve the user's email based on the username
-<4> Use the `MailSender` API to send the email to the user with the magic link
+<4> Use the `JavaMailSender` API to send the email to the user with the magic link
 <5> Use the `RedirectOneTimeTokenGenerationSuccessHandler` to perform a redirect to your desired URL
 
 The email content will look similar to:
@@ -72,15 +193,70 @@ The default submit page will detect that the URL has the `token` query param and
 == Changing the One-Time Token Generate URL
 
 By default, the javadoc:org.springframework.security.web.authentication.ott.GenerateOneTimeTokenFilter[] listens to `POST /ott/generate` requests.
-That URL can be changed by using the `tokenGeneratingUrl(String)` DSL method:
+That URL can be changed by using the `generateTokenUrl(String)` DSL method:
 
-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Changing the Generate URL
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .tokenGeneratingUrl("/ott/my-generate-url")
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+        @Bean
+        open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+            http {
+                //...
+                formLogin { }
+                oneTimeTokenLogin {
+                    tokenGeneratingUrl = "/ott/my-generate-url"
+                }
+            }
+            return http.build()
+        }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======
 
 [NOTE]
 ====
-The URI passed to `tokenGeneratingUrl` is matched literally.
-If you want it to live under your application servlet's base path, include that prefix explicitly — for example, `tokenGeneratingUrl("/api/ott/generate")`.
+The URI passed to `generateTokenUrl` is matched literally.
+If you want it to live under your application servlet's base path, include that prefix explicitly — for example, `generateTokenUrl("/api/ott/generate")`.
 The same applies to `loginProcessingUrl` and `tokenGeneratingUrl` elsewhere on this page.
 ====
 
@@ -90,17 +266,151 @@ The same applies to `loginProcessingUrl` and `tokenGeneratingUrl` elsewhere on t
 The default One-Time Token submit page is generated by the javadoc:org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter[] and listens to `GET /login/ott`.
 The URL can also be changed, like so:
 
-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Configuring the Default Submit Page URL
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .defaultSubmitPageUrl("/ott/submit")
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+        @Bean
+        open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+            http {
+                //...
+                formLogin { }
+                oneTimeTokenLogin {
+                    defaultSubmitPageUrl = "/ott/submit"
+                }
+            }
+            return http.build()
+        }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======
 
 [[disabling-default-submit-page]]
 == Disabling the Default Submit Page
 
 If you want to use your own One-Time Token submit page, you can disable the default page and then provide your own endpoint.
 
-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
-include-code::./MyController[tag=snippet,indent=0]
+.Disabling the Default Submit Page
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            .authorizeHttpRequests((authorize) -> authorize
+                .requestMatchers("/my-ott-submit").permitAll()
+                .anyRequest().authenticated()
+            )
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .showDefaultSubmitPage(false)
+            );
+        return http.build();
+    }
+
+}
+
+@Controller
+public class MyController {
+
+    @GetMapping("/my-ott-submit")
+    public String ottSubmitPage() {
+        return "my-ott-submit";
+    }
+
+}
+
+@Component
+public class OneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+   @Bean
+   open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+            http {
+                authorizeHttpRequests {
+                    authorize("/my-ott-submit", authenticated)
+                    authorize(anyRequest, authenticated)
+                }
+                formLogin { }
+                oneTimeTokenLogin {
+                    showDefaultSubmitPage = false
+                }
+            }
+            return http.build()
+    }
+}
+
+@Controller
+class MyController {
+
+   @GetMapping("/my-ott-submit")
+   fun ottSubmitPage(): String {
+       return "my-ott-submit"
+   }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======
 
 [[customize-generate-consume-token]]
 == Customize How to Generate and Consume One-Time Tokens
@@ -119,21 +429,164 @@ Some of the most common reasons to customize the `OneTimeTokenService` are, but
 There are two options to customize the `OneTimeTokenService`.
 One option is to provide it as a bean, so it can be automatically be picked-up by the `oneTimeTokenLogin()` DSL:
 
-include-code::./OneTimeTokenServiceBeanSecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Passing the OneTimeTokenService as a Bean
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+    @Bean
+    public OneTimeTokenService oneTimeTokenService() {
+        return new MyCustomOneTimeTokenService();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+    @Bean
+    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+        http {
+            //...
+            formLogin { }
+            oneTimeTokenLogin { }
+        }
+        return http.build()
+    }
+
+    @Bean
+    open fun oneTimeTokenService(): OneTimeTokenService {
+        return MyCustomOneTimeTokenService()
+    }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======
 
 The second option is to pass the `OneTimeTokenService` instance to the DSL, which is useful if there are multiple `SecurityFilterChain` and a different `OneTimeTokenService` is needed for each of them.
 
-include-code::./OneTimeTokenServiceDSLSecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Passing the OneTimeTokenService using the DSL
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .oneTimeTokenService(new MyCustomOneTimeTokenService())
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+    @Bean
+    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+        http {
+            //...
+            formLogin { }
+            oneTimeTokenLogin {
+                oneTimeTokenService = MyCustomOneTimeTokenService()
+            }
+        }
+        return http.build()
+    }
+
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======
 
 [[customize-generate-token-request]]
 == Customize GenerateOneTimeTokenRequest Instance
 There are a number of reasons that you may want to adjust an GenerateOneTimeTokenRequest. For example, you may want expiresIn to be set to 10 mins, which Spring Security sets to 5 mins by default.
 
-You can customize elements of GenerateOneTimeTokenRequest by publishing an GenerateOneTimeTokenRequestResolver as a `@Bean`, like so:
+You can customize elements of GenerateOneTimeTokenRequest by publishing an GenerateOneTimeTokenRequestResolver as a @Bean, like so:
+[tabs]
+======
+Java::
++
+[source,java,role="primary"]
+----
+@Bean
+GenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
+    DefaultGenerateOneTimeTokenRequestResolver delegate = new DefaultGenerateOneTimeTokenRequestResolver();
+        return (request) -> {
+		    GenerateOneTimeTokenRequest generate = delegate.resolve(request);
+		    return new GenerateOneTimeTokenRequest(generate.getUsername(), Duration.ofSeconds(600));
+	};
+}
+----
 
-include-code::./SecurityConfig[tag=config,indent=0]
+Kotlin::
++
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun generateRequestResolver() : GenerateOneTimeTokenRequestResolver {
+    return DefaultGenerateOneTimeTokenRequestResolver().apply {
+        this.setExpiresIn(Duration.ofMinutes(10))
+    }
+}
+----
+======
 
 [[validating-account-status]]
 == Validating Account Status

docs/modules/ROOT/pages/whats-new.adoc

@@ -8,8 +8,3 @@
 == Web
 
 * Since Spring Framework's `HttpMethod#valueOf` now normalizes casing, `StrictServerWebExchangeFirewall` no longer detects a non-canonical-case HTTP method (for example, `get` instead of `GET`) as a distinct value; such requests are processed as the canonical method instead of being rejected. Applications with a customized `ServerExchangeRejectedHandler` should be aware it is no longer invoked for this case.
-
-== OAuth 2.0
-
-* https://github.com/spring-projects/spring-security/pull/18895[gh-18895] - Add `authenticationSuccessHandler` to the Reactive Resource Server DSL
-

docs/package.json

@@ -1,6 +1,6 @@
 {
   "dependencies": {
-    "antora": "3.2.0-rc.3",
+    "antora": "3.2.0-rc.2",
     "@antora/atlas-extension": "1.0.0-alpha.5",
     "@antora/collector-extension": "1.0.3",
     "@asciidoctor/tabs": "1.0.0-beta.6",

docs/spring-security-docs.gradle

@@ -49,7 +49,6 @@ dependencies {
 	testImplementation 'org.springframework:spring-websocket'
 
 	testImplementation 'org.springframework:spring-webmvc'
-	testImplementation 'org.springframework:spring-context-support'
 	testImplementation 'jakarta.servlet:jakarta.servlet-api'
 	testImplementation 'io.mockk:mockk'
 	testImplementation "org.junit.jupiter:junit-jupiter-api"

docs/src/test/java/org/springframework/security/docs/reactive/authentication/changinggenerateurl/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.changinggenerateurl;
-
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-		/**/ return Mono.empty();
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/changinggenerateurl/SecurityConfig.java

@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.changinggenerateurl;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.tokenGeneratingUrl("/ott/my-generate-url")
-			);
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/changingsubmitpageurl/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.changingsubmitpageurl;
-
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-		/**/ return Mono.empty();
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/changingsubmitpageurl/SecurityConfig.java

@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.changingsubmitpageurl;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.defaultSubmitPageUrl("/ott/submit")
-			);
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegenerateconsumetoken/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
-
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-		/**/ return Mono.empty();
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegenerateconsumetoken/MyCustomReactiveOneTimeTokenService.java

@@ -1,38 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
-
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
-import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService;
-import reactor.core.publisher.Mono;
-
-class MyCustomReactiveOneTimeTokenService implements ReactiveOneTimeTokenService {
-
-
-	@Override
-	public Mono<OneTimeToken> generate(GenerateOneTimeTokenRequest request) {
-		return null;
-	}
-
-	@Override
-	public Mono<OneTimeToken> consume(OneTimeTokenAuthenticationToken authenticationToken) {
-		return null;
-	}
-
-}

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegenerateconsumetoken/OneTimeTokenServiceBeanSecurityConfig.java

@@ -1,48 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken.MyCustomReactiveOneTimeTokenService;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class OneTimeTokenServiceBeanSecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin(Customizer.withDefaults());
-		return http.build();
-	}
-
-	@Bean
-	public ReactiveOneTimeTokenService oneTimeTokenService() {
-		return new MyCustomReactiveOneTimeTokenService();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegenerateconsumetoken/OneTimeTokenServiceDSLSecurityConfig.java

@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class OneTimeTokenServiceDSLSecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.tokenService(new MyCustomReactiveOneTimeTokenService())
-			);
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/customizegeneratetokenrequest/SecurityConfig.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegeneratetokenrequest;
-
-import java.time.Duration;
-import org.springframework.context.annotation.Bean;
-import org.springframework.security.web.server.authentication.ott.DefaultServerGenerateOneTimeTokenRequestResolver;
-import org.springframework.security.web.server.authentication.ott.ServerGenerateOneTimeTokenRequestResolver;
-
-public class SecurityConfig {
-
-	// tag::config[]
-	@Bean
-  ServerGenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
-		DefaultServerGenerateOneTimeTokenRequestResolver resolver = new DefaultServerGenerateOneTimeTokenRequestResolver();
-		resolver.setExpiresIn(Duration.ofMinutes(10));
-		return resolver;
-	}
-	// end::config[]
-
-}

docs/src/test/java/org/springframework/security/docs/reactive/authentication/disablingdefaultsubmitpage/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-		/**/ return Mono.empty();
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/disablingdefaultsubmitpage/MyController.java

@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-
-// tag::snippet[]
-@Controller
-public class MyController {
-
-	@GetMapping("/my-ott-submit")
-	public String ottSubmitPage() {
-		return "my-ott-submit";
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/disablingdefaultsubmitpage/SecurityConfig.java

@@ -1,46 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			.authorizeExchange((authorize) -> authorize
-				.pathMatchers("/my-ott-submit").permitAll()
-				.anyExchange().authenticated()
-			)
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.showDefaultSubmitPage(false)
-			);
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/sendingtokentouser/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,84 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.sendingtokentouser;
-
-import org.springframework.mail.MailSender;
-import org.springframework.mail.SimpleMailMessage;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.security.web.server.authentication.ott.ServerRedirectOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.util.UriComponentsBuilder;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component // <1>
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	private final MailSender mailSender;
-
-	private final ServerOneTimeTokenGenerationSuccessHandler redirectHandler = new ServerRedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");
-
-	public MagicLinkOneTimeTokenGenerationSuccessHandler(MailSender mailSender) {
-		this.mailSender = mailSender;
-	}
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-
-		return Mono.just(exchange.getRequest())
-			.map((request) ->
-				UriComponentsBuilder.fromUri(request.getURI())
-					.replacePath(request.getPath().contextPath().value())
-					.replaceQuery(null)
-					.fragment(null)
-					.path("/login/ott")
-					.queryParam("token", oneTimeToken.getTokenValue())
-					.toUriString() // <2>
-			)
-			.flatMap((uri) -> {
-
-				String email = getUserEmail(oneTimeToken.getUsername()); // <3>
-				SimpleMailMessage message = new SimpleMailMessage();
-				message.setTo(email);
-				message.setSubject("Your Spring Security One Time Token");
-				message.setText("Use the following link to sign in into the application: " + uri);
-				this.mailSender.send(message); // <4>
-				return Mono.empty();
-			})
-			.then(this.redirectHandler.handle(exchange, oneTimeToken)); // <5>
-	}
-
-	private String getUserEmail(String username) {
-		/**/ return username;
-	}
-
-}
-
-@Controller
-class PageController {
-
-	@GetMapping("/ott/sent")
-	String ottSent() {
-		return "my-template";
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/reactive/authentication/sendingtokentouser/SecurityConfig.java

@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.sendingtokentouser;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin(Customizer.withDefaults());
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/changinggenerateurl/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.changinggenerateurl;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) {
-		// ...
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/changinggenerateurl/SecurityConfig.java

@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.changinggenerateurl;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.tokenGeneratingUrl("/ott/my-generate-url")
-			);
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/changingsubmitpageurl/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.changingsubmitpageurl;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) {
-		// ...
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/changingsubmitpageurl/SecurityConfig.java

@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.changingsubmitpageurl;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.defaultSubmitPageUrl("/ott/submit")
-			);
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/customizegenerateconsumetoken/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegenerateconsumetoken;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) {
-		// ...
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/customizegenerateconsumetoken/MyCustomOneTimeTokenService.java

@@ -1,37 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegenerateconsumetoken;
-
-import org.jspecify.annotations.Nullable;
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
-import org.springframework.security.authentication.ott.OneTimeTokenService;
-
-class MyCustomOneTimeTokenService implements OneTimeTokenService {
-
-	@Override
-	public OneTimeToken generate(GenerateOneTimeTokenRequest request) {
-		return null;
-	}
-
-	@Override
-	public @Nullable OneTimeToken consume(OneTimeTokenAuthenticationToken authenticationToken) {
-		return null;
-	}
-
-}

docs/src/test/java/org/springframework/security/docs/servlet/authentication/customizegenerateconsumetoken/OneTimeTokenServiceBeanSecurityConfig.java

@@ -1,47 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegenerateconsumetoken;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.authentication.ott.OneTimeTokenService;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class OneTimeTokenServiceBeanSecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-				// ...
-				.formLogin(Customizer.withDefaults())
-				.oneTimeTokenLogin(Customizer.withDefaults());
-		return http.build();
-	}
-
-	@Bean
-	public OneTimeTokenService oneTimeTokenService() {
-		return new MyCustomOneTimeTokenService();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/customizegenerateconsumetoken/OneTimeTokenServiceDSLSecurityConfig.java

@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegenerateconsumetoken;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class OneTimeTokenServiceDSLSecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.tokenService(new MyCustomOneTimeTokenService())
-			);
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/customizegeneratetokenrequest/SecurityConfig.java

@@ -1,39 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegeneratetokenrequest;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
-import org.springframework.security.web.authentication.ott.DefaultGenerateOneTimeTokenRequestResolver;
-import org.springframework.security.web.authentication.ott.GenerateOneTimeTokenRequestResolver;
-
-import java.time.Duration;
-
-public class SecurityConfig {
-
-	// tag::config[]
-	@Bean
-	GenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
-		DefaultGenerateOneTimeTokenRequestResolver delegate = new DefaultGenerateOneTimeTokenRequestResolver();
-		return (request) -> {
-			GenerateOneTimeTokenRequest generate = delegate.resolve(request);
-			return new GenerateOneTimeTokenRequest(generate.getUsername(), Duration.ofMinutes(10));
-		};
-	}
-	// end::config[]
-
-}

docs/src/test/java/org/springframework/security/docs/servlet/authentication/disablingdefaultsubmitpage/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.disablingdefaultsubmitpage;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) {
-		// ...
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/disablingdefaultsubmitpage/MyController.java

@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-
-// tag::snippet[]
-@Controller
-public class MyController {
-
-	@GetMapping("/my-ott-submit")
-	public String ottSubmitPage() {
-		return "my-ott-submit";
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/disablingdefaultsubmitpage/SecurityConfig.java

@@ -1,46 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			.authorizeHttpRequests((authorize) -> authorize
-				.requestMatchers("/my-ott-submit").permitAll()
-				.anyRequest().authenticated()
-			)
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.showDefaultSubmitPage(false)
-			);
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/sendingtokentouser/MagicLinkOneTimeTokenGenerationSuccessHandler.java

@@ -1,80 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.sendingtokentouser;
-
-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.mail.MailSender;
-import org.springframework.mail.SimpleMailMessage;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.security.web.authentication.ott.RedirectOneTimeTokenGenerationSuccessHandler;
-import org.springframework.security.web.util.UrlUtils;
-import org.springframework.stereotype.Component;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.util.UriComponentsBuilder;
-
-import java.io.IOException;
-
-// tag::snippet[]
-@Component // <1>
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	private final MailSender mailSender;
-
-	private final OneTimeTokenGenerationSuccessHandler redirectHandler = new RedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");
-
-	public MagicLinkOneTimeTokenGenerationSuccessHandler(MailSender mailSender) {
-		this.mailSender = mailSender;
-	}
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException {
-		UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))
-				.replacePath(request.getContextPath())
-				.replaceQuery(null)
-				.fragment(null)
-				.path("/login/ott")
-				.queryParam("token", oneTimeToken.getTokenValue()); // <2>
-		String magicLink = builder.toUriString();
-		String email = getUserEmail(oneTimeToken.getUsername()); // <3>
-		SimpleMailMessage message = new SimpleMailMessage();
-		message.setTo(email);
-		message.setSubject("Your Spring Security One Time Token");
-		message.setText("Use the following link to sign in into the application: " + magicLink);
-		this.mailSender.send(message); // <4>
-		this.redirectHandler.handle(request, response, oneTimeToken); // <5>
-	}
-
-	private String getUserEmail(String username) {
-		/**/ return username;
-	}
-
-}
-
-@Controller
-class PageController {
-
-	@GetMapping("/ott/sent")
-	String ottSent() {
-		return "my-template";
-	}
-
-}
-// end::snippet[]

docs/src/test/java/org/springframework/security/docs/servlet/authentication/sendingtokentouser/SecurityConfig.java

@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.sendingtokentouser;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin(Customizer.withDefaults());
-		return http.build();
-	}
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/changinggenerateurl/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.changinggenerateurl
-
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.web.server.ServerWebExchange
-import reactor.core.publisher.Mono
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : ServerOneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-        /**/ return Mono.empty()
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/changinggenerateurl/SecurityConfig.kt

@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.changinggenerateurl
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class SecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            // ...
-            formLogin { }
-            oneTimeTokenLogin {
-                tokenGeneratingUrl = "/ott/my-generate-url"
-            }
-        }
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/changingsubmitpageurl/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.changingsubmitpageurl
-
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.web.server.ServerWebExchange
-import reactor.core.publisher.Mono
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : ServerOneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-        /**/ return Mono.empty()
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/changingsubmitpageurl/SecurityConfig.kt

@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.changingsubmitpageurl
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class SecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            // ...
-            formLogin { }
-            oneTimeTokenLogin {
-                defaultSubmitPageUrl = "/ott/submit"
-            }
-        }
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/customizegenerateconsumetoken/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken
-
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.web.server.ServerWebExchange
-import reactor.core.publisher.Mono
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : ServerOneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-        /**/ return Mono.empty()
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/customizegenerateconsumetoken/MyCustomReactiveOneTimeTokenService.kt

@@ -1,36 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken
-
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken
-import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService
-import reactor.core.publisher.Mono
-
-class MyCustomReactiveOneTimeTokenService: ReactiveOneTimeTokenService {
-
-    override fun generate(request: GenerateOneTimeTokenRequest): Mono<OneTimeToken> {
-        TODO("Not yet implemented")
-    }
-
-    override fun consume(authenticationToken: OneTimeTokenAuthenticationToken): Mono<OneTimeToken> {
-        TODO("Not yet implemented")
-    }
-
-
-}

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/customizegenerateconsumetoken/OneTimeTokenServiceBeanSecurityConfig.kt

@@ -1,46 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class OneTimeTokenServiceBeanSecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            //..
-            formLogin { }
-            oneTimeTokenLogin { }
-        }
-    }
-
-    @Bean
-    open fun oneTimeTokenService(): ReactiveOneTimeTokenService {
-        return MyCustomReactiveOneTimeTokenService()
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/customizegenerateconsumetoken/OneTimeTokenServiceDSLSecurityConfig.kt

@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class OneTimeTokenServiceDSLSecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            //..
-            formLogin { }
-            oneTimeTokenLogin {
-                tokenService = MyCustomReactiveOneTimeTokenService()
-            }
-        }
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/customizegeneratetokenrequest/SecurityConfig.kt

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegeneratetokenrequest
-
-import org.springframework.context.annotation.Bean
-import org.springframework.security.web.server.authentication.ott.DefaultServerGenerateOneTimeTokenRequestResolver
-import org.springframework.security.web.server.authentication.ott.ServerGenerateOneTimeTokenRequestResolver
-import java.time.Duration
-
-open class SecurityConfig {
-
-    // tag::config[]
-    @Bean
-    fun generateOneTimeTokenRequestResolver() : ServerGenerateOneTimeTokenRequestResolver {
-        return DefaultServerGenerateOneTimeTokenRequestResolver().apply {
-            this.setExpiresIn(Duration.ofMinutes(10))
-        }
-    }
-    // end::config[]
-
-}

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/disablingdefaultsubmitpage/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.disablingdefaultsubmitpage
-
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.web.server.ServerWebExchange
-import reactor.core.publisher.Mono
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : ServerOneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-        /**/ return Mono.empty()
-    }
-
-}
-
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/disablingdefaultsubmitpage/MyController.kt

@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.disablingdefaultsubmitpage
-
-import org.springframework.stereotype.Controller
-import org.springframework.web.bind.annotation.GetMapping
-
-// tag::snippet[]
-@Controller
-class MyController {
-
-    @GetMapping("/my-ott-submit")
-    fun ottSubmitPage(): String {
-        return "my-ott-submit"
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/disablingdefaultsubmitpage/SecurityConfig.kt

@@ -1,45 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.disablingdefaultsubmitpage
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class SecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            authorizeExchange {
-                authorize(pathMatchers("/my-ott-submit"), permitAll)
-                authorize(anyExchange, authenticated)
-            }
-            formLogin { }
-            oneTimeTokenLogin {
-                showDefaultSubmitPage = false
-            }
-        }
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/sendingtokentouser/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,78 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.sendingtokentouser
-
-import org.springframework.mail.MailSender
-import org.springframework.mail.SimpleMailMessage
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.security.web.server.authentication.ott.ServerRedirectOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.stereotype.Controller
-import org.springframework.web.bind.annotation.GetMapping
-import org.springframework.web.server.ServerWebExchange
-import org.springframework.web.util.UriComponentsBuilder
-import reactor.core.publisher.Mono
-import java.util.function.Function
-
-
-// tag::snippet[]
-@Component // <1>
-class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender) : ServerOneTimeTokenGenerationSuccessHandler {
-
-    private val redirectHandler: ServerOneTimeTokenGenerationSuccessHandler = ServerRedirectOneTimeTokenGenerationSuccessHandler("/ott/sent")
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-
-        return Mono.just(exchange.request)
-            .map(Function { request ->
-                UriComponentsBuilder.fromUri(request.uri)
-                    .replacePath(request.path.contextPath().value())
-                    .replaceQuery(null)
-                    .fragment(null)
-                    .path("/login/ott")
-                    .queryParam("token", oneTimeToken.getTokenValue())
-                    .toUriString() // <2>
-            })
-            .flatMap(Function { uri ->
-                val email = getUserEmail(oneTimeToken.getUsername()) // <3>
-                val message = SimpleMailMessage()
-                message.setTo(email)
-                message.subject = "Your Spring Security One Time Token"
-                message.text = "Use the following link to sign in into the application: $uri"
-                this.mailSender.send(message) // <4>
-                Mono.empty()
-            })
-            .then(this.redirectHandler.handle(exchange, oneTimeToken)) // <5>
-    }
-
-    private fun getUserEmail(username: String): String {
-        /**/ return username
-    }
-
-}
-
-@Controller
-class PageController {
-
-    @GetMapping("/ott/sent")
-    fun ottSent(): String {
-        return "my-template"
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/reactive/authentication/sendingtokentouser/SecurityConfig.kt

@@ -1,40 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.sendingtokentouser
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class SecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            authorizeExchange {
-                authorize(anyExchange, authenticated)
-            }
-            oneTimeTokenLogin { }
-        }
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/changinggenerateurl/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.changinggenerateurl
-
-import jakarta.servlet.http.HttpServletRequest
-import jakarta.servlet.http.HttpServletResponse
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        // ...
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/changinggenerateurl/SecurityConfig.kt

@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.changinggenerateurl
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class SecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            //...
-            formLogin { }
-            oneTimeTokenLogin {
-                tokenGeneratingUrl = "/ott/my-generate-url"
-            }
-        }
-        return http.build()
-    }
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/changingsubmitpageurl/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.changingsubmitpageurl
-
-import jakarta.servlet.http.HttpServletRequest
-import jakarta.servlet.http.HttpServletResponse
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        // ...
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/changingsubmitpageurl/SecurityConfig.kt

@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.changingsubmitpageurl
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class SecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            //...
-            formLogin { }
-            oneTimeTokenLogin {
-                defaultSubmitPageUrl = "/ott/submit"
-            }
-        }
-        return http.build()
-    }
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/customizegenerateconsumetoken/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegenerateconsumetoken
-
-import jakarta.servlet.http.HttpServletRequest
-import jakarta.servlet.http.HttpServletResponse
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        // ...
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/customizegenerateconsumetoken/MyCustomOneTimeTokenService.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegenerateconsumetoken
-
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken
-import org.springframework.security.authentication.ott.OneTimeTokenService
-
-class MyCustomOneTimeTokenService: OneTimeTokenService {
-
-    override fun generate(request: GenerateOneTimeTokenRequest): OneTimeToken {
-        TODO("Not yet implemented")
-    }
-
-    override fun consume(authenticationToken: OneTimeTokenAuthenticationToken): OneTimeToken? {
-        TODO("Not yet implemented")
-    }
-
-}

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/customizegenerateconsumetoken/OneTimeTokenServiceBeanSecurityConfig.kt

@@ -1,48 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegenerateconsumetoken
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.authentication.ott.OneTimeTokenService
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class OneTimeTokenServiceBeanSecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            //...
-            formLogin { }
-            oneTimeTokenLogin { }
-        }
-        return http.build()
-    }
-
-    @Bean
-    open fun oneTimeTokenService(): OneTimeTokenService {
-        return MyCustomOneTimeTokenService()
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/customizegenerateconsumetoken/OneTimeTokenServiceDSLSecurityConfig.kt

@@ -1,44 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegenerateconsumetoken
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class OneTimeTokenServiceDSLSecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            //...
-            formLogin { }
-            oneTimeTokenLogin {
-                tokenService = MyCustomOneTimeTokenService()
-            }
-        }
-        return http.build()
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/customizegeneratetokenrequest/SecurityConfig.kt

@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegeneratetokenrequest
-
-import org.springframework.context.annotation.Bean
-import org.springframework.security.web.authentication.ott.DefaultGenerateOneTimeTokenRequestResolver
-import org.springframework.security.web.authentication.ott.GenerateOneTimeTokenRequestResolver
-import java.time.Duration
-
-open class SecurityConfig {
-
-    // tag::config[]
-    @Bean
-    open fun generateRequestResolver() : GenerateOneTimeTokenRequestResolver {
-        return DefaultGenerateOneTimeTokenRequestResolver().apply {
-            this.setExpiresIn(Duration.ofMinutes(10))
-        }
-    }
-    // end::config[]
-
-}

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/disablingdefaultsubmitpage/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.disablingdefaultsubmitpage
-
-import jakarta.servlet.http.HttpServletRequest
-import jakarta.servlet.http.HttpServletResponse
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        // ...
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/disablingdefaultsubmitpage/MyController.kt

@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.disablingdefaultsubmitpage
-
-import org.springframework.stereotype.Controller
-import org.springframework.web.bind.annotation.GetMapping
-
-// tag::snippet[]
-@Controller
-class MyController {
-
-    @GetMapping("/my-ott-submit")
-    fun ottSubmitPage(): String {
-        return "my-ott-submit"
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/disablingdefaultsubmitpage/SecurityConfig.kt

@@ -1,47 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.disablingdefaultsubmitpage
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class SecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            authorizeHttpRequests {
-                authorize("/my-ott-submit", authenticated)
-                authorize(anyRequest, authenticated)
-            }
-            formLogin { }
-            oneTimeTokenLogin {
-                showDefaultSubmitPage = false
-            }
-        }
-        return http.build()
-    }
-
-}
-// end::config[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/sendingtokentouser/MagicLinkOneTimeTokenGenerationSuccessHandler.kt

@@ -1,69 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.sendingtokentouser
-
-import jakarta.servlet.http.HttpServletRequest
-import jakarta.servlet.http.HttpServletResponse
-import org.springframework.mail.MailSender
-import org.springframework.mail.SimpleMailMessage
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler
-import org.springframework.security.web.authentication.ott.RedirectOneTimeTokenGenerationSuccessHandler
-import org.springframework.security.web.util.UrlUtils
-import org.springframework.stereotype.Component
-import org.springframework.stereotype.Controller
-import org.springframework.web.bind.annotation.GetMapping
-import org.springframework.web.util.UriComponentsBuilder
-
-// tag::snippet[]
-@Component // <1>
-class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender) : OneTimeTokenGenerationSuccessHandler {
-
-    private val redirectHandler: OneTimeTokenGenerationSuccessHandler = RedirectOneTimeTokenGenerationSuccessHandler("/ott/sent")
-
-    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        val builder = UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))
-            .replacePath(request.contextPath)
-            .replaceQuery(null)
-            .fragment(null)
-            .path("/login/ott")
-            .queryParam("token", oneTimeToken.getTokenValue()) // <2>
-        val magicLink = builder.toUriString()
-        val email = getUserEmail(oneTimeToken.getUsername()) // <3>
-        val message = SimpleMailMessage()
-        message.setTo(email)
-        message.subject = "Your Spring Security One Time Token"
-        message.text = "Use the following link to sign in into the application: $magicLink"
-        this.mailSender.send(message) // <4>
-        this.redirectHandler.handle(request, response, oneTimeToken) // <5>
-    }
-
-    private fun getUserEmail(username: String): String {
-        /**/ return username
-    }
-}
-
-@Controller
-class PageController {
-
-    @GetMapping("/ott/sent")
-    fun ottSent(): String {
-        return "my-template"
-    }
-
-}
-// end::snippet[]

docs/src/test/kotlin/org/springframework/security/kt/docs/servlet/authentication/sendingtokentouser/SecurityConfig.kt

@@ -1,40 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.sendingtokentouser
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class SecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            formLogin { }
-            oneTimeTokenLogin { }
-        }
-        return http.build()
-    }
-}
-// end::config[]

gradle/libs.versions.toml

@@ -2,7 +2,7 @@
 com-squareup-okhttp3 = "3.14.9"
 io-micrometer = "1.18.0-M1"
 io-rsocket = "1.1.5"
-io-spring-javaformat = "0.0.47"
+io-spring-javaformat = "0.0.48"
 io-spring-nohttp = "0.0.11"
 jakarta-websocket = "2.2.0"
 org-apache-maven-resolver = "1.9.27"

kerberos/kerberos-client/src/main/java/org/springframework/security/kerberos/client/KerberosRestTemplate.java

@@ -248,9 +248,6 @@ public class KerberosRestTemplate extends RestTemplate {
 			});
 
 		}
-		catch (RestClientException ex) {
-			throw ex;
-		}
 		catch (Exception ex) {
 			throw new RestClientException("Error running rest call", ex);
 		}

kerberos/kerberos-client/src/test/java/org/springframework/security/kerberos/client/KerberosRestTemplateTests.java

@@ -19,8 +19,6 @@ package org.springframework.security.kerberos.client;
 import java.io.File;
 import java.nio.charset.StandardCharsets;
 import java.util.Collections;
-import java.util.HashMap;
-import java.util.Map;
 
 import okhttp3.mockwebserver.Dispatcher;
 import okhttp3.mockwebserver.MockResponse;
@@ -35,10 +33,8 @@ import org.springframework.http.HttpHeaders;
 import org.springframework.http.MediaType;
 import org.springframework.security.kerberos.test.KerberosSecurityTestcase;
 import org.springframework.security.kerberos.test.MiniKdc;
-import org.springframework.web.client.HttpClientErrorException;
 
 import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
 
 class KerberosRestTemplateTests extends KerberosSecurityTestcase {
 
@@ -76,8 +72,6 @@ class KerberosRestTemplateTests extends KerberosSecurityTestcase {
 		String serverPrincipal = "HTTP/localhost";
 		File serverKeytab = new File(workDir, "server.keytab");
 		kdc.createPrincipal(serverKeytab, serverPrincipal);
-
-		setUpClient();
 	}
 
 	@AfterEach
@@ -87,21 +81,13 @@ class KerberosRestTemplateTests extends KerberosSecurityTestcase {
 
 	@Test
 	void sendsNegotiateHeader() {
+		setUpClient();
 		String s = this.restTemplate.getForObject(this.baseUrl + "/get", String.class);
 		assertThat(s).isEqualTo(helloWorld);
 	}
 
-	@Test
-	void throwsOriginalException() {
-		assertThatExceptionOfType(HttpClientErrorException.NotFound.class)
-			.isThrownBy(() -> this.restTemplate.getForObject(this.baseUrl + "/notfound", String.class));
-	}
-
 	private void setUpClient() {
-		Map<String, Object> loginOptions = new HashMap<>();
-		loginOptions.put("refreshKrb5Config", "true");
-		this.restTemplate = new KerberosRestTemplate(this.clientKeytab.getAbsolutePath(), this.clientPrincipal,
-				loginOptions);
+		this.restTemplate = new KerberosRestTemplate(this.clientKeytab.getAbsolutePath(), this.clientPrincipal);
 	}
 
 	private MockResponse getRequest(RecordedRequest request, byte[] body, String contentType) {

oauth2/oauth2-client/src/main/java/org/springframework/security/oauth2/client/RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler.java

@@ -24,12 +24,9 @@ import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 
-import org.apache.commons.logging.Log;
-import org.apache.commons.logging.LogFactory;
 import org.jspecify.annotations.Nullable;
 import reactor.core.publisher.Mono;
 
-import org.springframework.core.log.LogMessage;
 import org.springframework.security.core.Authentication;
 import org.springframework.security.core.GrantedAuthority;
 import org.springframework.security.core.authority.mapping.GrantedAuthoritiesMapper;
@@ -82,7 +79,7 @@ public final class RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler
 			.map((c) -> c.get(ServerWebExchange.class));
 	// @formatter:on
 
-	private ServerSecurityContextRepository serverSecurityContextRepository = new NonRotatingWebSessionServerSecurityContextRepository();
+	private ServerSecurityContextRepository serverSecurityContextRepository = new WebSessionServerSecurityContextRepository();
 
 	private ReactiveJwtDecoderFactory<ClientRegistration> jwtDecoderFactory = new ReactiveOidcIdTokenDecoderFactory();
 
@@ -144,7 +141,8 @@ public final class RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler
 
 	/**
 	 * Sets a {@link ServerSecurityContextRepository} to use for refreshing a
-	 * {@link SecurityContext}.
+	 * {@link SecurityContext}, defaults to
+	 * {@link WebSessionServerSecurityContextRepository}.
 	 * @param serverSecurityContextRepository the {@link ServerSecurityContextRepository}
 	 * to use
 	 */
@@ -318,28 +316,4 @@ public final class RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler
 		return this.serverSecurityContextRepository.save(exchange, securityContext);
 	}
 
-	private static final class NonRotatingWebSessionServerSecurityContextRepository
-			implements ServerSecurityContextRepository {
-
-		private static final Log logger = LogFactory.getLog(NonRotatingWebSessionServerSecurityContextRepository.class);
-
-		@Override
-		public Mono<SecurityContext> load(ServerWebExchange exchange) {
-			return Mono.empty();
-		}
-
-		@Override
-		public Mono<Void> save(ServerWebExchange exchange, @Nullable SecurityContext context) {
-			Assert.notNull(context, "context cannot be null");
-			// Save SecurityContext in WebSession without rotating session id.
-			return exchange.getSession().doOnNext((session) -> {
-				session.getAttributes()
-					.put(WebSessionServerSecurityContextRepository.DEFAULT_SPRING_SECURITY_CONTEXT_ATTR_NAME, context);
-				logger.debug(LogMessage.format("Saved SecurityContext '%s' in WebSession: '%s'", context, session));
-			}).then();
-
-		}
-
-	}
-
 }

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandlerTests.java

@@ -50,9 +50,7 @@ import org.springframework.security.oauth2.jwt.ReactiveJwtDecoder;
 import org.springframework.security.oauth2.jwt.ReactiveJwtDecoderFactory;
 import org.springframework.security.web.server.context.WebSessionServerSecurityContextRepository;
 import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.server.WebSession;
 
-import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatException;
 import static org.mockito.ArgumentMatchers.any;
 import static org.mockito.BDDMockito.given;
@@ -142,51 +140,6 @@ class RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandlerTests {
 			.verifyComplete();
 	}
 
-	// gh-19424
-	@Test
-	void onAuthorizationSuccessWhenDefaultServerSecurityContextRepositoryThenWebSessionIdNotChanged() {
-		ClientRegistration clientRegistration = TestClientRegistrations.clientRegistration().build();
-		Instant authTime = Instant.now();
-		DefaultOidcUser principal = createOidcUser(authTime);
-		OAuth2AuthenticationToken authenticationToken = new OAuth2AuthenticationToken(principal,
-				principal.getAuthorities(), clientRegistration.getRegistrationId());
-		OAuth2AccessToken accessToken = createAccessToken();
-		OAuth2AuthorizedClient authorizedClient = new OAuth2AuthorizedClient(clientRegistration, principal.getName(),
-				accessToken, null);
-		MockServerWebExchange exchange = MockServerWebExchange.from(MockServerHttpRequest.get("/").build());
-		Map<String, Object> attributes = Map.of(ServerWebExchange.class.getName(), exchange,
-				OidcParameterNames.ID_TOKEN, "id-token-1234");
-		Map<String, Object> claims = new HashMap<>();
-		claims.put("iss", principal.getIssuer());
-		claims.put("sub", principal.getSubject());
-		claims.put("aud", principal.getAudience());
-		claims.put("auth_time", authTime);
-		claims.put("nonce", principal.getNonce());
-		Jwt jwt = mock(Jwt.class);
-		given(jwt.getTokenValue()).willReturn("id-token-1234");
-		given(jwt.getIssuedAt()).willReturn(principal.getIssuedAt());
-		given(jwt.getClaims()).willReturn(claims);
-		ReactiveJwtDecoder jwtDecoder = mock(ReactiveJwtDecoder.class);
-		given(jwtDecoder.decode(any())).willReturn(Mono.just(jwt));
-		ReactiveJwtDecoderFactory<ClientRegistration> reactiveJwtDecoderFactory = mock(ReactiveJwtDecoderFactory.class);
-		given(reactiveJwtDecoderFactory.createDecoder(any())).willReturn(jwtDecoder);
-		ReactiveOAuth2UserService<OidcUserRequest, OidcUser> userService = mock(ReactiveOAuth2UserService.class);
-		given(userService.loadUser(any())).willReturn(Mono.just(principal));
-		RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler handler = new RefreshOidcUserReactiveOAuth2AuthorizationSuccessHandler();
-		handler.setJwtDecoderFactory(reactiveJwtDecoderFactory);
-		handler.setUserService(userService);
-		String originalSessionId = exchange.getSession().map(WebSession::getId).block();
-		StepVerifier.create(handler.onAuthorizationSuccess(authorizedClient, authenticationToken, attributes))
-			.verifyComplete();
-		StepVerifier.create(exchange.getSession())
-			.assertNext((session) -> assertThat(session.getId()).isEqualTo(originalSessionId))
-			.verifyComplete();
-		WebSessionServerSecurityContextRepository securityContextRepository = new WebSessionServerSecurityContextRepository();
-		StepVerifier.create(securityContextRepository.load(exchange).mapNotNull(SecurityContext::getAuthentication))
-			.expectNext(authenticationToken)
-			.verifyComplete();
-	}
-
 	@Test
 	void onAuthorizationSuccessWhenIdTokenIssuerNotSameThenException() {
 		ClientRegistration clientRegistration = TestClientRegistrations.clientRegistration().build();

oauth2/oauth2-client/src/test/java/org/springframework/security/oauth2/client/web/reactive/function/client/ServerOAuth2AuthorizedClientExchangeFilterFunctionITests.java

@@ -35,7 +35,6 @@ import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.ArgumentCaptor;
 import reactor.core.publisher.Mono;
-import reactor.test.StepVerifier;
 import reactor.util.context.Context;
 
 import org.springframework.http.HttpHeaders;
@@ -78,7 +77,6 @@ import org.springframework.web.reactive.function.client.ExchangeFunction;
 import org.springframework.web.reactive.function.client.WebClient;
 import org.springframework.web.reactive.function.client.WebClientResponseException;
 import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.server.WebSession;
 
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
@@ -322,8 +320,6 @@ public class ServerOAuth2AuthorizedClientExchangeFilterFunctionITests {
 		doReturn(Mono.just(authorizedClient)).when(this.authorizedClientRepository)
 			.loadAuthorizedClient(eq(clientRegistration.getRegistrationId()), eq(this.authentication),
 					eq(this.exchange));
-		// Capture the original session id.
-		String originalSessionId = this.exchange.getSession().map(WebSession::getId).block();
 		this.webClient.get()
 			.uri(this.serverUrl)
 			.attributes(ServletOAuth2AuthorizedClientExchangeFilterFunction
@@ -360,10 +356,6 @@ public class ServerOAuth2AuthorizedClientExchangeFilterFunctionITests {
 				assertThat(oidcUser.getSubject()).isEqualTo("subject-1234");
 				assertThat(oidcUser.getName()).isEqualTo("refreshed-username");
 			});
-		// Verify that session id was not changed.
-		StepVerifier.create(this.exchange.getSession())
-			.assertNext((session) -> assertThat(session.getId()).isEqualTo(originalSessionId))
-			.verifyComplete();
 	}
 
 	@Test

oauth2/oauth2-resource-server/src/main/java/org/springframework/security/oauth2/server/resource/authentication/BearerTokenAuthentication.java

@@ -53,7 +53,7 @@ public class BearerTokenAuthentication extends AbstractOAuth2TokenAuthentication
 	public BearerTokenAuthentication(OAuth2AuthenticatedPrincipal principal, OAuth2AccessToken credentials,
 			Collection<? extends GrantedAuthority> authorities) {
 		super(credentials, principal, credentials, authorities);
-		Assert.isTrue(OAuth2AccessToken.TokenType.BEARER.equals(credentials.getTokenType()),
+		Assert.isTrue(credentials.getTokenType() == OAuth2AccessToken.TokenType.BEARER,
 				"credentials must be a bearer token");
 		this.attributes = Collections.unmodifiableMap(new LinkedHashMap<>(principal.getAttributes()));
 		setAuthenticated(true);
@@ -121,8 +121,7 @@ public class BearerTokenAuthentication extends AbstractOAuth2TokenAuthentication
 		 */
 		@Override
 		public B token(OAuth2AccessToken token) {
-			Assert.isTrue(OAuth2AccessToken.TokenType.BEARER.equals(token.getTokenType()),
-					"token must be a bearer token");
+			Assert.isTrue(token.getTokenType() == OAuth2AccessToken.TokenType.BEARER, "token must be a bearer token");
 			super.credentials(token);
 			return super.token(token);
 		}

oauth2/oauth2-resource-server/src/test/java/org/springframework/security/oauth2/server/resource/authentication/BearerTokenAuthenticationTests.java

@@ -173,32 +173,4 @@ public class BearerTokenAuthenticationTests {
 		assertThat(authorities).containsExactlyInAnyOrder("FACTOR_ONE", "FACTOR_TWO");
 	}
 
-	// gh-19377
-	@Test
-	public void compareCredentialsHasBearerTokenType() {
-		Instant current = Instant.now();
-		Instant after1hour = Instant.now().plusSeconds(3600);
-		OAuth2AccessToken oAuth2AccessToken = new OAuth2AccessToken(new OAuth2AccessToken.TokenType("Bearer"), "token",
-				current, after1hour);
-		BearerTokenAuthentication authenticated = new BearerTokenAuthentication(this.principal, oAuth2AccessToken,
-				this.authorities);
-		assertThat(authenticated.getName()).isEqualTo(this.name);
-		assertThat(authenticated.getCredentials())
-			.isEqualTo(new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "token", current, after1hour));
-	}
-
-	// gh-19377
-	@Test
-	public void toBuilderCompareCredentialsHasBearerTokenType() {
-		Instant current = Instant.now();
-		Instant after1hour = Instant.now().plusSeconds(3600);
-		OAuth2AccessToken oAuth2AccessToken = new OAuth2AccessToken(new OAuth2AccessToken.TokenType("Bearer"), "token",
-				current, after1hour);
-		BearerTokenAuthentication token = new BearerTokenAuthentication(this.principal, this.token, this.authorities);
-		BearerTokenAuthentication authenticated = token.toBuilder().token(oAuth2AccessToken).build();
-		assertThat(authenticated.getName()).isEqualTo(this.name);
-		assertThat(authenticated.getCredentials())
-			.isEqualTo(new OAuth2AccessToken(OAuth2AccessToken.TokenType.BEARER, "token", current, after1hour));
-	}
-
 }

web/src/main/java/org/springframework/security/web/header/HeaderWriterFilter.java

@@ -18,7 +18,6 @@ package org.springframework.security.web.header;
 
 import java.io.IOException;
 import java.util.List;
-import java.util.concurrent.atomic.AtomicBoolean;
 
 import jakarta.servlet.FilterChain;
 import jakarta.servlet.RequestDispatcher;
@@ -115,8 +114,6 @@ public class HeaderWriterFilter extends OncePerRequestFilter {
 
 		private final HttpServletRequest request;
 
-		private final AtomicBoolean headersWritten = new AtomicBoolean(false);
-
 		HeaderWriterResponse(HttpServletRequest request, HttpServletResponse response) {
 			super(response);
 			this.request = request;
@@ -132,9 +129,7 @@ public class HeaderWriterFilter extends OncePerRequestFilter {
 			if (isDisableOnResponseCommitted()) {
 				return;
 			}
-			if (this.headersWritten.compareAndSet(false, true)) {
-				HeaderWriterFilter.this.writeHeaders(this.request, getHttpResponse());
-			}
+			HeaderWriterFilter.this.writeHeaders(this.request, getHttpResponse());
 		}
 
 		private HttpServletResponse getHttpResponse() {

web/src/test/java/org/springframework/security/web/header/HeaderWriterFilterTests.java

@@ -113,25 +113,6 @@ public class HeaderWriterFilterTests {
 		verifyNoMoreInteractions(this.writer1);
 	}
 
-	// gh-9175
-	@Test
-	public void doFilterWhenWriteHeadersCalledConcurrentlyThenHeadersWrittenOnlyOnce() throws Exception {
-		List<HeaderWriter> headerWriters = new ArrayList<>();
-		headerWriters.add(this.writer1);
-		HeaderWriterFilter filter = new HeaderWriterFilter(headerWriters);
-		MockHttpServletRequest request = new MockHttpServletRequest();
-		MockHttpServletResponse response = new MockHttpServletResponse();
-		filter.doFilter(request, response, (req, resp) ->
-		// Calling writeHeaders() directly simulates the race window where an
-		// async thread enters writeHeaders() via onResponseCommitted() but has
-		// not yet called disableOnResponseCommitted().
-		((HeaderWriterFilter.HeaderWriterResponse) resp).writeHeaders());
-		// The finally block in doHeadersAfter also calls writeHeaders().
-		// Without the fix, the header writers would be invoked twice.
-		verify(this.writer1).writeHeaders(any(HttpServletRequest.class), any(HttpServletResponse.class));
-		verifyNoMoreInteractions(this.writer1);
-	}
-
 	@Test
 	public void headersWrittenAtBeginningOfRequest() throws Exception {
 		HeaderWriterFilter filter = new HeaderWriterFilter(Collections.singletonList(this.writer1));