Bump org.seleniumhq.selenium:htmlunit3-driver from 4.43.0 to 4.47.0

Bumps [org.seleniumhq.selenium:htmlunit3-driver](https://github.com/SeleniumHQ/htmlunit-driver) from 4.43.0 to 4.47.0. - [Release notes](https://github.com/SeleniumHQ/htmlunit-driver/releases) - [Commits](https://github.com/SeleniumHQ/htmlunit-driver/compare/4.43.0...4.47.0) --- updated-dependencies: - dependency-name: org.seleniumhq.selenium:htmlunit3-driver dependency-version: 4.47.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>
2026-09-05 08:49:54 +00:00 · 2026-08-17 03:05:46 +00:00
141 changed files with 1251 additions and 5105 deletions
@@ -4,6 +4,7 @@ on:
  pull_request:
    branches:
      - main
+      - '*.x'
      - 'docs-build'

 run-name: Merge Dependabot PR ${{ github.ref_name }}
@@ -13,4 +14,4 @@ jobs:
    permissions: write-all
    uses: spring-io/spring-github-workflows/.github/workflows/spring-merge-dependabot-pr.yml@0d3f15bb384839966a1ff5c4383731a2b747f24b # v7
    with:
-      mergeArguments: --auto --rebase
+      mergeArguments: --auto --rebase
@@ -14,7 +14,7 @@ permissions:
 jobs:
  snapshot-test:
    name: Test Against Snapshots
-    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    uses: spring-io/spring-security-release-tools/.github/workflows/test.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
    strategy:
      matrix:
        include:
@@ -31,6 +31,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -17,7 +17,7 @@ permissions:
 jobs:
  build:
    name: Build
-    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    uses: spring-io/spring-security-release-tools/.github/workflows/build.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
    strategy:
      matrix:
        os: [ ubuntu-latest, windows-latest ]
@@ -30,7 +30,7 @@ jobs:
  deploy-artifacts:
    name: Deploy Artifacts
    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-artifacts.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
    with:
      should-deploy-artifacts: ${{ needs.build.outputs.should-deploy-artifacts }}
      default-publish-milestones-central: true
@@ -39,7 +39,7 @@ jobs:
  deploy-schema:
    name: Deploy Schema
    needs: [ build ]
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
    with:
      should-deploy-schema: ${{ needs.build.outputs.should-deploy-artifacts }}
      java-version: 25
@@ -51,6 +51,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -18,21 +18,21 @@ jobs:
      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
    - name: Compute Version
      id: compute-version
-      uses: spring-io/spring-release-actions/compute-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      uses: spring-io/spring-release-actions/compute-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
    - name: Get Today's Release Version
      id: todays-release
-      uses: spring-io/spring-release-actions/get-todays-release-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      uses: spring-io/spring-release-actions/get-todays-release-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
      with:
        snapshot-version: ${{ steps.compute-version.outputs.version }}
        milestone-repository: ${{ github.repository }}
        milestone-token: ${{ secrets.GITHUB_TOKEN }}
    - name: Compute Next Version
      id: next-version
-      uses: spring-io/spring-release-actions/compute-next-version@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      uses: spring-io/spring-release-actions/compute-next-version@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
      with:
        version: ${{ steps.todays-release.outputs.release-version }}
    - name: Schedule Next Milestone
-      uses: spring-io/spring-release-actions/schedule-milestone@1b8671612c3eb3d9b9763e2d7b66f1a80d00ee95 # 0.0.6
+      uses: spring-io/spring-release-actions/schedule-milestone@a1f321783a0769dd2aea4fad6c2ae2f95a52b885 # 0.0.5
      with:
        version: ${{ steps.next-version.outputs.version }}
        version-date: ${{ steps.next-version.outputs.version-date }}
@@ -22,7 +22,7 @@ jobs:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
      - name: Set up JDK 25
-        uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
        with:
          java-version: '25'
          distribution: 'temurin'
@@ -46,6 +46,6 @@ jobs:
    runs-on: ubuntu-latest
    steps:
      - name: Send Notification
-        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
+        uses: spring-io/spring-security-release-tools/.github/actions/send-notification@b92832ecbc7cbe969201e6beafbde0ee400cf095 # v1.0.15
        with:
          webhook-url: ${{ secrets.SPRING_SECURITY_CI_GCHAT_WEBHOOK_URL }}
@@ -1,30 +0,0 @@
-name: Release Announcements - Publish
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: The version to publish
-        required: true
-        type: string
-
-permissions:
-  actions: write
-  contents: read
-  issues: write
-
-jobs:
-  deploy-schema:
-    name: Deploy Schema
-    uses: spring-io/spring-security-release-tools/.github/workflows/deploy-schema.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    with:
-      should-deploy-schema: true
-    secrets: inherit
-  publish-release-announcements:
-    name: Publish Release Announcements
-    needs: [ deploy-schema ]
-    if: ${{ !github.event.repository.fork }}
-    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-publish.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    with:
-      version: ${{ inputs.version }}
-    secrets: inherit
@@ -1,24 +0,0 @@
-name: Release Announcements - Stage
-
-on:
-  push:
-    tags:
-      - '[0-9]+.[0-9]+.[0-9]+'
-  workflow_dispatch:
-    inputs:
-      version:
-        description: The version to stage
-        required: true
-        type: string
-
-permissions:
-  contents: read
-
-jobs:
-  stage-release-announcements:
-    name: Stage Release Announcements
-    if: ${{ !github.event.repository.fork }}
-    uses: spring-io/spring-security-release-tools/.github/workflows/release-announcements-stage.yml@3f6cc7ffc137ca160061749d5f34dc30d5f36986 # v1.0.17
-    with:
-      version: ${{ inputs.version || github.ref_name }}
-    secrets: inherit
@@ -17,7 +17,6 @@
 package org.springframework.security.config.annotation.authentication.configurers.ldap;

 import java.io.IOException;
-import java.net.InetAddress;
 import java.net.ServerSocket;

 import org.springframework.ldap.core.support.BaseLdapPathContextSource;
@@ -591,7 +590,7 @@ public class LdapAuthenticationProviderConfigurer<B extends ProviderManagerBuild
 		}

 		private int getDefaultPort() {
-			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
+			try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
 				return serverSocket.getLocalPort();
 			}
 			catch (IOException ex) {
@@ -32,7 +32,6 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.context.annotation.ImportAware;
 import org.springframework.context.annotation.Role;
 import org.springframework.core.type.AnnotationMetadata;
-import org.springframework.security.access.PermissionEvaluator;
 import org.springframework.security.access.expression.method.DefaultMethodSecurityExpressionHandler;
 import org.springframework.security.access.expression.method.MethodSecurityExpressionHandler;
 import org.springframework.security.access.hierarchicalroles.RoleHierarchy;
@@ -128,11 +127,6 @@ final class PrePostMethodSecurityConfiguration implements ImportAware, Applicati
 		this.expressionHandler.setAuthorizationManagerFactory(authorizationManagerFactory);
 	}

-	@Autowired(required = false)
-	void setPermissionEvaluator(PermissionEvaluator permissionEvaluator) {
-		this.expressionHandler.setPermissionEvaluator(permissionEvaluator);
-	}
-
 	@Autowired(required = false)
 	void setTemplateDefaults(AnnotationTemplateExpressionDefaults templateDefaults) {
 		this.preFilterMethodInterceptor.setTemplateDefaults(templateDefaults);
@@ -706,10 +706,8 @@ public final class OAuth2ResourceServerConfigurer<H extends HttpSecurityBuilder<
 		}

 		private void configure(H http) {
-			DPoPAuthenticationProvider authenticationProvider = new DPoPAuthenticationProvider(
-					getTokenAuthenticationManager(http));
-			http.authenticationProvider(postProcess(authenticationProvider));
 			AuthenticationManager authenticationManager = http.getSharedObject(AuthenticationManager.class);
+			http.authenticationProvider(new DPoPAuthenticationProvider(getTokenAuthenticationManager(http)));
 			AuthenticationFilter authenticationFilter = new AuthenticationFilter(authenticationManager,
 					getAuthenticationConverter());
 			authenticationFilter.setRequestMatcher(getRequestMatcher());
@@ -17,7 +17,6 @@
 package org.springframework.security.config.ldap;

 import java.io.IOException;
-import java.net.InetAddress;
 import java.net.ServerSocket;

 import org.w3c.dom.Element;
@@ -189,7 +188,7 @@ public class LdapServerBeanDefinitionParser implements BeanDefinitionParser {
 	}

 	private String getDefaultPort() {
-		try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT, 50, InetAddress.getLoopbackAddress())) {
+		try (ServerSocket serverSocket = new ServerSocket(DEFAULT_PORT)) {
 			return String.valueOf(serverSocket.getLocalPort());
 		}
 		catch (IOException ex) {
@@ -297,7 +297,6 @@ import org.springframework.web.util.pattern.PathPatternParser;
 * @author Ankur Pathak
 * @author Alexey Nesterov
 * @author Yanming Zhou
- * @author Iain Henderson
 * @since 5.0
 */
 public class ServerHttpSecurity {
@@ -4139,8 +4138,6 @@ public class ServerHttpSecurity {

 		private ServerAuthenticationFailureHandler authenticationFailureHandler;

-		private ServerAuthenticationSuccessHandler authenticationSuccessHandler;
-
 		private ServerAccessDeniedHandler accessDeniedHandler = new BearerTokenServerAccessDeniedHandler();

 		private ServerAuthenticationConverter bearerTokenConverter = new ServerBearerTokenAuthenticationConverter();
@@ -4189,20 +4186,6 @@ public class ServerHttpSecurity {
 			return this;
 		}

-		/**
-		 * Configures the {@link ServerAuthenticationSuccessHandler} to use. The default
-		 * is {@link WebFilterChainServerAuthenticationSuccessHandler}
-		 * @param authenticationSuccessHandler the
-		 * {@link ServerAuthenticationSuccessHandler} to use
-		 * @return the {@link OAuth2ClientSpec} to customize
-		 * @since 7.2
-		 */
-		public OAuth2ResourceServerSpec authenticationSuccessHandler(
-				ServerAuthenticationSuccessHandler authenticationSuccessHandler) {
-			this.authenticationSuccessHandler = authenticationSuccessHandler;
-			return this;
-		}
-
 		/**
 		 * Configures the {@link ServerAuthenticationConverter} to use for requests
 		 * authenticating with
@@ -4271,7 +4254,6 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(this.authenticationManagerResolver);
 				oauth2.setServerAuthenticationConverter(this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
-				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}
 			else if (this.jwt != null) {
@@ -4331,13 +4313,6 @@ public class ServerHttpSecurity {
 			return new ServerAuthenticationEntryPointFailureHandler(this.entryPoint);
 		}

-		private ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
-			if (this.authenticationSuccessHandler != null) {
-				return this.authenticationSuccessHandler;
-			}
-			return new WebFilterChainServerAuthenticationSuccessHandler();
-		}
-
 		/**
 		 * Configures JWT Resource Server Support
 		 */
@@ -4412,7 +4387,6 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(authenticationManager);
 				oauth2.setServerAuthenticationConverter(OAuth2ResourceServerSpec.this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
-				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}

@@ -4545,7 +4519,6 @@ public class ServerHttpSecurity {
 				AuthenticationWebFilter oauth2 = new AuthenticationWebFilter(authenticationManager);
 				oauth2.setServerAuthenticationConverter(OAuth2ResourceServerSpec.this.bearerTokenConverter);
 				oauth2.setAuthenticationFailureHandler(authenticationFailureHandler());
-				oauth2.setAuthenticationSuccessHandler(authenticationSuccessHandler());
 				http.addFilterAt(oauth2, SecurityWebFiltersOrder.AUTHENTICATION);
 			}

@@ -20,7 +20,6 @@ import org.springframework.security.authentication.ReactiveAuthenticationManager
 import org.springframework.security.web.server.ServerAuthenticationEntryPoint
 import org.springframework.security.web.server.authentication.ServerAuthenticationConverter
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler
-import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler
 import org.springframework.security.web.server.authorization.ServerAccessDeniedHandler
 import org.springframework.web.server.ServerWebExchange

@@ -36,8 +35,6 @@ import org.springframework.web.server.ServerWebExchange
 * @property bearerTokenConverter the [ServerAuthenticationConverter] to use for requests authenticating with
 * Bearer Tokens.
 * @property authenticationManagerResolver the [ReactiveAuthenticationManagerResolver] to use.
- * @property authenticationSuccessHandler the [ServerAuthenticationSuccessHandler] to use after
- * authentication success.
 */
@ServerSecurityMarker
 class ServerOAuth2ResourceServerDsl {
@@ -46,7 +43,6 @@ class ServerOAuth2ResourceServerDsl {
    var authenticationEntryPoint: ServerAuthenticationEntryPoint? = null
    var bearerTokenConverter: ServerAuthenticationConverter? = null
    var authenticationManagerResolver: ReactiveAuthenticationManagerResolver<ServerWebExchange>? = null
-    var authenticationSuccessHandler: ServerAuthenticationSuccessHandler? = null

    private var jwt: ((ServerHttpSecurity.OAuth2ResourceServerSpec.JwtSpec) -> Unit)? = null
    private var opaqueToken: ((ServerHttpSecurity.OAuth2ResourceServerSpec.OpaqueTokenSpec) -> Unit)? = null
@@ -119,7 +115,6 @@ class ServerOAuth2ResourceServerDsl {
            authenticationEntryPoint?.also { oauth2ResourceServer.authenticationEntryPoint(authenticationEntryPoint) }
            bearerTokenConverter?.also { oauth2ResourceServer.bearerTokenConverter(bearerTokenConverter) }
            authenticationManagerResolver?.also { oauth2ResourceServer.authenticationManagerResolver(authenticationManagerResolver!!) }
-            authenticationSuccessHandler?.also { oauth2ResourceServer.authenticationSuccessHandler(authenticationSuccessHandler) }
            jwt?.also { oauth2ResourceServer.jwt(jwt) }
            opaqueToken?.also { oauth2ResourceServer.opaqueToken(opaqueToken) }
        }
@@ -25,12 +25,12 @@ public class MockSecurityContextHolderStrategy implements SecurityContextHolderS
 	private SecurityContext context;

 	@Override
-	public synchronized void clearContext() {
+	public void clearContext() {
 		this.context = null;
 	}

 	@Override
-	public synchronized SecurityContext getContext() {
+	public SecurityContext getContext() {
 		if (this.context == null) {
 			this.context = createEmptyContext();
 		}
@@ -38,7 +38,7 @@ public class MockSecurityContextHolderStrategy implements SecurityContextHolderS
 	}

 	@Override
-	public synchronized void setContext(SecurityContext context) {
+	public void setContext(SecurityContext context) {
 		this.context = context;
 	}

@@ -1527,13 +1527,13 @@ public class PrePostMethodSecurityConfigurationTests {

 	}

-	@Configuration
 	@EnableMethodSecurity
 	static class CustomPermissionEvaluatorConfig {

 		@Bean
-		PermissionEvaluator permissionEvaluator() {
-			return new PermissionEvaluator() {
+		MethodSecurityExpressionHandler methodSecurityExpressionHandler() {
+			DefaultMethodSecurityExpressionHandler expressionHandler = new DefaultMethodSecurityExpressionHandler();
+			expressionHandler.setPermissionEvaluator(new PermissionEvaluator() {
 				@Override
 				public boolean hasPermission(Authentication authentication, Object targetDomainObject,
 						Object permission) {
@@ -1545,7 +1545,8 @@ public class PrePostMethodSecurityConfigurationTests {
 						Object permission) {
 					throw new UnsupportedOperationException();
 				}
-			};
+			});
+			return expressionHandler;
 		}

 	}
@@ -22,7 +22,6 @@ import java.security.interfaces.ECPrivateKey;
 import java.security.interfaces.ECPublicKey;
 import java.security.interfaces.RSAPrivateKey;
 import java.security.interfaces.RSAPublicKey;
-import java.time.Duration;
 import java.time.Instant;
 import java.time.temporal.ChronoUnit;
 import java.util.Base64;
@@ -31,7 +30,6 @@ import java.util.HashMap;
 import java.util.Map;
 import java.util.Set;
 import java.util.UUID;
-import java.util.function.Function;

 import com.nimbusds.jose.jwk.ECKey;
 import com.nimbusds.jose.jwk.JWK;
@@ -49,26 +47,20 @@ import org.springframework.context.annotation.Configuration;
 import org.springframework.http.HttpHeaders;
 import org.springframework.http.HttpMethod;
 import org.springframework.security.config.Customizer;
-import org.springframework.security.config.ObjectPostProcessor;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
 import org.springframework.security.config.test.SpringTestContext;
 import org.springframework.security.config.test.SpringTestContextExtension;
-import org.springframework.security.oauth2.core.OAuth2TokenValidator;
 import org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames;
 import org.springframework.security.oauth2.jose.TestJwks;
 import org.springframework.security.oauth2.jose.TestKeys;
 import org.springframework.security.oauth2.jose.jws.SignatureAlgorithm;
-import org.springframework.security.oauth2.jwt.DPoPProofContext;
-import org.springframework.security.oauth2.jwt.DPoPProofJwtDecoderFactory;
-import org.springframework.security.oauth2.jwt.DPoPProofReplayValidator;
 import org.springframework.security.oauth2.jwt.JwsHeader;
 import org.springframework.security.oauth2.jwt.Jwt;
 import org.springframework.security.oauth2.jwt.JwtClaimsSet;
 import org.springframework.security.oauth2.jwt.JwtEncoderParameters;
 import org.springframework.security.oauth2.jwt.NimbusJwtDecoder;
 import org.springframework.security.oauth2.jwt.NimbusJwtEncoder;
-import org.springframework.security.oauth2.server.resource.authentication.DPoPAuthenticationProvider;
 import org.springframework.security.web.SecurityFilterChain;
 import org.springframework.test.web.servlet.MockMvc;
 import org.springframework.web.bind.annotation.RequestMapping;
@@ -255,8 +247,8 @@ public class DPoPAuthenticationTests {
 				)
 				.oauth2ResourceServer((oauth2) -> oauth2
 						.jwt(Customizer.withDefaults())
-						.dPoP(Customizer.withDefaults())
-						.withObjectPostProcessor(dPoPProofVerifierFactoryCustomizer()));
+						.dPoP(Customizer.withDefaults()));
+
 			// @formatter:on
 			return http.build();
 		}
@@ -266,25 +258,6 @@ public class DPoPAuthenticationTests {
 			return NimbusJwtDecoder.withPublicKey(PROVIDER_RSA_PUBLIC_KEY).build();
 		}

-		private ObjectPostProcessor<DPoPAuthenticationProvider> dPoPProofVerifierFactoryCustomizer() {
-			return new ObjectPostProcessor<>() {
-				@Override
-				public <O extends DPoPAuthenticationProvider> O postProcess(O authenticationProvider) {
-					DPoPProofReplayValidator.InMemoryCache inMemoryCache = new DPoPProofReplayValidator.InMemoryCache();
-					inMemoryCache.setMaxSize(50_000);
-					inMemoryCache.setMaxRequestsPerKey(500);
-					DPoPProofReplayValidator dPoPProofReplayValidator = new DPoPProofReplayValidator(inMemoryCache);
-					dPoPProofReplayValidator.setClockSkew(Duration.ofSeconds(60));
-					Function<DPoPProofContext, OAuth2TokenValidator<Jwt>> jwtValidatorFactory = DPoPProofJwtDecoderFactory
-						.createDefaultJwtValidatorFactory(Collections.singletonList(dPoPProofReplayValidator));
-					DPoPProofJwtDecoderFactory dPoPProofJwtDecoderFactory = new DPoPProofJwtDecoderFactory();
-					dPoPProofJwtDecoderFactory.setJwtValidatorFactory(jwtValidatorFactory);
-					authenticationProvider.setDPoPProofVerifierFactory(dPoPProofJwtDecoderFactory);
-					return authenticationProvider;
-				}
-			};
-		}
-
 	}

 	@RestController
@@ -73,11 +73,9 @@ import org.springframework.security.oauth2.server.resource.authentication.Reacti
 import org.springframework.security.oauth2.server.resource.authentication.ReactiveJwtAuthenticationConverterAdapter;
 import org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenAuthenticationConverter;
 import org.springframework.security.web.server.SecurityWebFilterChain;
-import org.springframework.security.web.server.WebFilterExchange;
 import org.springframework.security.web.server.authentication.HttpStatusServerEntryPoint;
 import org.springframework.security.web.server.authentication.ServerAuthenticationConverter;
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler;
-import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler;
 import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler;
 import org.springframework.test.web.reactive.server.WebTestClient;
 import org.springframework.web.bind.annotation.GetMapping;
@@ -373,79 +371,6 @@ public class OAuth2ResourceServerSpecTests {
 		verify(handler).onAuthenticationFailure(any(), any());
 	}

-	@Test
-	public void getWhenUsingCustomAuthenticationSuccessHandlerThenUsesIsAccordingly() {
-		this.spring.register(CustomAuthenticationSuccessHandlerAuthenticationManagerResolverConfig.class).autowire();
-		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
-			.getBean(ServerAuthenticationSuccessHandler.class);
-		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
-			.getBean(ReactiveAuthenticationManager.class);
-		given(authenticationManager.authenticate(any()))
-			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
-		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
-			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
-			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
-		});
-		// @formatter:off
-		this.client.get()
-				.headers((headers) -> headers.setBearerAuth(this.messageReadToken))
-				.exchange()
-				.expectStatus().isUnauthorized();
-		// @formatter:on
-		verify(handler).onAuthenticationSuccess(any(), any());
-	}
-
-	@Test
-	public void getWhenUsingCustomAuthenticationSuccessHandlerWithJwtThenUsesIsAccordingly() {
-		this.spring.register(CustomAuthenticationSuccessHandlerJwtConfig.class).autowire();
-		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
-			.getBean(ServerAuthenticationSuccessHandler.class);
-		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
-			.getBean(ReactiveAuthenticationManager.class);
-		given(authenticationManager.authenticate(any()))
-			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
-		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
-			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
-			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
-		});
-		// @formatter:off
-		this.client.get()
-				.headers((headers) -> headers.setBearerAuth(this.messageReadToken))
-				.exchange()
-				.expectStatus().isUnauthorized();
-		// @formatter:on
-		verify(handler).onAuthenticationSuccess(any(), any());
-	}
-
-	@Test
-	public void getWhenUsingCustomAuthenticationSuccessHandlerWIthOpaqueTokenThenUsesIsAccordingly() {
-		this.spring.register(CustomAuthenticationSuccessHandlerOpaqueTokenConfig.class, RootController.class)
-			.autowire();
-		this.spring.getContext()
-			.getBean(MockWebServer.class)
-			.setDispatcher(requiresAuth(this.clientId, this.clientSecret, this.active));
-		ServerAuthenticationSuccessHandler handler = this.spring.getContext()
-			.getBean(ServerAuthenticationSuccessHandler.class);
-		ReactiveAuthenticationManager authenticationManager = this.spring.getContext()
-			.getBean(ReactiveAuthenticationManager.class);
-		given(authenticationManager.authenticate(any()))
-			.willAnswer((input) -> Mono.just(input.getArgument(0, Authentication.class)));
-		given(handler.onAuthenticationSuccess(any(), any())).willAnswer((input) -> {
-			WebFilterExchange webFilterExchange = input.getArgument(0, WebFilterExchange.class);
-			return webFilterExchange.getChain().filter(webFilterExchange.getExchange());
-		});
-		// @formatter:off
-		this.client.get()
-				.headers((headers) -> headers
-						.setBearerAuth(this.messageReadToken)
-				)
-				.exchange()
-				.expectStatus().isOk();
-		// @formatter:on
-
-		verify(handler).onAuthenticationSuccess(any(), any());
-	}
-
 	@Test
 	public void postWhenSignedThenReturnsOk() {
 		this.spring.register(PublicKeyConfig.class, RootController.class).autowire();
@@ -1025,111 +950,6 @@ public class OAuth2ResourceServerSpecTests {

 	}

-	@Configuration
-	@EnableWebFlux
-	@EnableWebFluxSecurity
-	static class CustomAuthenticationSuccessHandlerAuthenticationManagerResolverConfig {
-
-		@Bean
-		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
-			// @formatter:off
-			http
-					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
-					.oauth2ResourceServer((oauth2) -> oauth2
-							.authenticationSuccessHandler(authenticationSuccessHandler())
-							.authenticationManagerResolver((exchange) -> Mono.just(authenticationManager()))
-					);
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		ReactiveAuthenticationManager authenticationManager() {
-			return mock(ReactiveAuthenticationManager.class);
-		}
-
-		@Bean
-		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
-			return mock(ServerAuthenticationSuccessHandler.class);
-		}
-
-	}
-
-	@Configuration
-	@EnableWebFlux
-	@EnableWebFluxSecurity
-	static class CustomAuthenticationSuccessHandlerJwtConfig {
-
-		@Bean
-		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
-			// @formatter:off
-			http
-					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
-					.oauth2ResourceServer((oauth2) -> oauth2
-							.authenticationSuccessHandler(authenticationSuccessHandler())
-							.jwt((jwt) -> jwt.authenticationManager(authenticationManager()))
-					);
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		ReactiveAuthenticationManager authenticationManager() {
-			return mock(ReactiveAuthenticationManager.class);
-		}
-
-		@Bean
-		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
-			return mock(ServerAuthenticationSuccessHandler.class);
-		}
-
-	}
-
-	@Configuration
-	@EnableWebFlux
-	@EnableWebFluxSecurity
-	static class CustomAuthenticationSuccessHandlerOpaqueTokenConfig {
-
-		private MockWebServer mockWebServer = new MockWebServer();
-
-		@Bean
-		SecurityWebFilterChain springSecurity(ServerHttpSecurity http) {
-			String introspectionUri = mockWebServer().url("/introspect").toString();
-			// @formatter:off
-			http
-					.authorizeExchange((authorize) -> authorize.anyExchange().authenticated())
-					.oauth2ResourceServer((oauth2) -> oauth2
-							.authenticationSuccessHandler(authenticationSuccessHandler())
-							.opaqueToken((opaqueToken) -> opaqueToken
-									.introspectionUri(introspectionUri)
-									.introspectionClientCredentials("client", "secret"))
-					);
-			// @formatter:on
-			return http.build();
-		}
-
-		@Bean
-		ReactiveAuthenticationManager authenticationManager() {
-			return mock(ReactiveAuthenticationManager.class);
-		}
-
-		@Bean
-		ServerAuthenticationSuccessHandler authenticationSuccessHandler() {
-			return mock(ServerAuthenticationSuccessHandler.class);
-		}
-
-		@Bean
-		MockWebServer mockWebServer() {
-			return this.mockWebServer;
-		}
-
-		@PreDestroy
-		void shutdown() throws IOException {
-			this.mockWebServer.shutdown();
-		}
-
-	}
-
 	@EnableWebFlux
 	@EnableWebFluxSecurity
 	static class CustomBearerTokenServerAuthenticationConverter {
@@ -17,7 +17,6 @@
 package org.springframework.security.config.web.server

 import io.mockk.every
-import io.mockk.mockk
 import io.mockk.mockkObject
 import io.mockk.verify
 import org.junit.jupiter.api.Test
@@ -38,7 +37,6 @@ import org.springframework.security.web.server.SecurityWebFilterChain
 import org.springframework.security.web.server.WebFilterExchange
 import org.springframework.security.web.server.authentication.HttpStatusServerEntryPoint
 import org.springframework.security.web.server.authentication.ServerAuthenticationFailureHandler
-import org.springframework.security.web.server.authentication.ServerAuthenticationSuccessHandler
 import org.springframework.security.web.server.authorization.HttpStatusServerAccessDeniedHandler
 import org.springframework.test.web.reactive.server.WebTestClient
 import org.springframework.web.reactive.config.EnableWebFlux
@@ -185,46 +183,6 @@ class ServerOAuth2ResourceServerDslTests {

    }

-    @Test
-    fun `request when custom authentication success handler then success handler used`() {
-        this.spring.register(AuthenticationSuccessHandlerConfig::class.java).autowire()
-        every {
-            AuthenticationSuccessHandlerConfig.SUCCESS_HANDLER.onAuthenticationSuccess(any(), any())
-        } returns Mono.empty()
-
-        this.client.get()
-            .uri("/")
-            .headers { it.setBearerAuth(validJwt) }
-            .exchange()
-
-        verify(exactly = 1) { AuthenticationSuccessHandlerConfig.SUCCESS_HANDLER.onAuthenticationSuccess(any(), any()) }
-    }
-
-    @Configuration
-    @EnableWebFluxSecurity
-    @EnableWebFlux
-    open class AuthenticationSuccessHandlerConfig {
-
-        companion object {
-            val SUCCESS_HANDLER: ServerAuthenticationSuccessHandler = mockk()
-        }
-
-        @Bean
-        open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-            return http {
-                authorizeExchange {
-                    authorize(anyExchange, authenticated)
-                }
-                oauth2ResourceServer {
-                    authenticationSuccessHandler = SUCCESS_HANDLER
-                    jwt {
-                        publicKey = publicKey()
-                    }
-                }
-            }
-        }
-    }
-
    @Test
    fun `request when custom bearer token converter configured then custom converter used`() {
        this.spring.register(BearerTokenConverterConfig::class.java).autowire()
@@ -34,6 +34,7 @@ import org.springframework.security.core.AuthenticationException;
 import org.springframework.security.core.CredentialsContainer;
 import org.springframework.security.core.SpringSecurityMessageSource;
 import org.springframework.util.Assert;
+import org.springframework.util.CollectionUtils;

 /**
 * Iterates an {@link Authentication} request through a list of
@@ -137,7 +138,8 @@ public class ProviderManager implements AuthenticationManager, MessageSourceAwar
 	private void checkState() {
 		Assert.isTrue(this.parent != null || !this.providers.isEmpty(),
 				"A parent AuthenticationManager or a list of AuthenticationProviders is required");
-		Assert.noNullElements(this.providers, "providers list cannot contain null values");
+		Assert.isTrue(!CollectionUtils.contains(this.providers.iterator(), null),
+				"providers list cannot contain null values");
 	}

 	/**
@@ -123,7 +123,7 @@ public final class PostFilterAuthorizationMethodInterceptor implements Authoriza
 	/**
 	 * Filter a {@code returnedObject} using the {@link PostFilter} annotation that the
 	 * {@link MethodInvocation} specifies.
-	 * @param mi the {@link MethodInvocation} to check
+	 * @param mi the {@link MethodInvocation} to check check
 	 * @return filtered {@code returnedObject}
 	 */
 	@Override
@@ -131,7 +131,7 @@ public final class DelegatingSecurityContextCallable<V> implements Callable<V> {
 	/**
 	 * Creates a {@link DelegatingSecurityContextCallable} and with the given
 	 * {@link Callable} and {@link SecurityContext}, but if the securityContext is null
-	 * will default to the current {@link SecurityContext} on the
+	 * will defaults to the current {@link SecurityContext} on the
 	 * {@link SecurityContextHolder}
 	 * @param delegate the delegate {@link DelegatingSecurityContextCallable} to run with
 	 * the specified {@link SecurityContext}. Cannot be null.
@@ -47,7 +47,7 @@ public final class DelegatingSecurityContextRunnable implements Runnable {
 		.getContextHolderStrategy();

 	/**
-	 * The {@link SecurityContext} that the delegate {@link Runnable} will be run as.
+	 * The {@link SecurityContext} that the delegate {@link Runnable} will be ran as.
 	 */
 	private SecurityContext delegateSecurityContext;

@@ -32,7 +32,6 @@ import org.springframework.util.Assert;
 * {@link java.util.ServiceLoader} mechanism when context-propagation is on the classpath.
 *
 * @author Steve Riesenberg
- * @author Tadaya Tsuyukubo
 * @since 6.5
 * @see io.micrometer.context.ContextRegistry
 */
@@ -54,9 +53,7 @@ public final class SecurityContextHolderThreadLocalAccessor implements ThreadLoc
 	@Override
 	public void setValue(SecurityContext securityContext) {
 		Assert.notNull(securityContext, "securityContext cannot be null");
-		SecurityContext newContext = SecurityContextHolder.createEmptyContext();
-		newContext.setAuthentication(securityContext.getAuthentication());
-		SecurityContextHolder.setContext(newContext);
+		SecurityContextHolder.setContext(securityContext);
 	}

 	@Override
@@ -132,7 +132,7 @@ public class KeyBasedPersistenceTokenService implements TokenService, Initializi
 		// Verification
 		String content = creationTime + ":" + pseudoRandomNumber + ":" + extendedInfo.toString();
 		String expectedSha512Hex = Sha512DigestUtils.shaHex(content + ":" + serverSecret);
-		Assert.isTrue(Utf8.isEqual(expectedSha512Hex, sha1Hex), "Key verification failure");
+		Assert.isTrue(expectedSha512Hex.equals(sha1Hex), "Key verification failure");
 		return new DefaultToken(key, creationTime, extendedInfo.toString());
 	}

@@ -35,7 +35,7 @@ import org.jspecify.annotations.Nullable;
 * building block for more sophisticated token-based solutions. For example,
 * authentication systems that depend on stateless session keys. These could, for
 * instance, place the username inside the user-specified extended information associated
- * with the key. It is important to recognise that we do not intend for this interface to
+ * with the key). It is important to recognise that we do not intend for this interface to
 * be expanded to provide such capabilities directly.
 * </p>
 *
@@ -323,7 +323,7 @@ public class User implements UserDetails, CredentialsContainer {

 	/**
 	 * Builds the user to be added. At minimum the username, password, and authorities
-	 * should be provided. The remaining attributes have reasonable defaults.
+	 * should provided. The remaining attributes have reasonable defaults.
 	 */
 	public static final class UserBuilder {

@@ -38,7 +38,7 @@ public interface UserDetailsService {
 	 * may possibly be case sensitive, or case insensitive depending on how the
 	 * implementation instance is configured. In this case, the <code>UserDetails</code>
 	 * object that comes back may have a username that is of a different case than what
-	 * was actually requested.
+	 * was actually requested..
 	 * @param username the username identifying the user whose data is required.
 	 * @return a fully populated user record (never <code>null</code>)
 	 * @throws UsernameNotFoundException if the user could not be found or the user has no
@@ -16,7 +16,7 @@

 /**
 * Contains simple user and authority group account provisioning interfaces together with
- * a JDBC-based implementation.
+ * a a JDBC-based implementation.
 */
@NullMarked
 package org.springframework.security.provisioning;
@@ -259,9 +259,7 @@ public final class InetAddressMatchers {
 			if (address.isLoopbackAddress() || address.isLinkLocalAddress() || address.isSiteLocalAddress()) {
 				return true;
 			}
-			if (address.isAnyLocalAddress()) {
-				return true;
-			}
+
 			byte[] rawAddress = address.getAddress();

 			if (rawAddress.length == 16) {
@@ -337,9 +335,6 @@ public final class InetAddressMatchers {

 		@Override
 		public boolean matches(@Nullable InetAddress address) {
-			if (address == null) {
-				return false;
-			}
 			return !this.internalMatcher.matches(address);
 		}

@@ -16,18 +16,11 @@

 package org.springframework.security.core.context;

-import java.util.concurrent.CountDownLatch;
-import java.util.concurrent.TimeUnit;
-import java.util.concurrent.atomic.AtomicReference;
-
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;

-import org.springframework.core.task.support.ContextPropagatingTaskDecorator;
-import org.springframework.scheduling.concurrent.ThreadPoolTaskExecutor;
 import org.springframework.security.authentication.TestingAuthenticationToken;
-import org.springframework.security.core.Authentication;

 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException;
@@ -36,7 +29,6 @@ import static org.assertj.core.api.Assertions.assertThatIllegalArgumentException
 * Tests for {@link SecurityContextHolderThreadLocalAccessor}.
 *
 * @author Steve Riesenberg
- * @author Tadaya Tsuyukubo
 */
 public class SecurityContextHolderThreadLocalAccessorTests {

@@ -73,11 +65,9 @@ public class SecurityContextHolderThreadLocalAccessorTests {
 	@Test
 	public void setValueWhenSecurityContextThenSetsSecurityContextHolder() {
 		SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
-		Authentication authentication = new TestingAuthenticationToken("user", "password");
-		securityContext.setAuthentication(authentication);
+		securityContext.setAuthentication(new TestingAuthenticationToken("user", "password"));
 		this.threadLocalAccessor.setValue(securityContext);
-		assertThat(SecurityContextHolder.getContext()).isNotSameAs(securityContext);
-		assertThat(SecurityContextHolder.getContext().getAuthentication()).isSameAs(authentication);
+		assertThat(SecurityContextHolder.getContext()).isSameAs(securityContext);
 	}

 	@Test
@@ -100,41 +90,4 @@ public class SecurityContextHolderThreadLocalAccessorTests {
 		assertThat(SecurityContextHolder.getContext()).isEqualTo(emptyContext);
 	}

-	@Test
-	public void newSecurityContextInDifferentThread() throws Exception {
-		Authentication authA = new TestingAuthenticationToken("foo", "password");
-		Authentication authB = new TestingAuthenticationToken("bar", "password");
-
-		SecurityContext securityContext = SecurityContextHolder.createEmptyContext();
-		securityContext.setAuthentication(authA);
-		SecurityContextHolder.setContext(securityContext);
-
-		CountDownLatch latch = new CountDownLatch(1);
-		AtomicReference<SecurityContext> contextHolder = new AtomicReference<>();
-		AtomicReference<Authentication> authHolder = new AtomicReference<>();
-		Runnable runnable = () -> {
-			SecurityContext context = SecurityContextHolder.getContext();
-			contextHolder.set(context);
-			authHolder.set(context.getAuthentication());
-			context.setAuthentication(authB);
-			latch.countDown();
-		};
-
-		ThreadPoolTaskExecutor executor = new ThreadPoolTaskExecutor();
-		executor.setTaskDecorator(new ContextPropagatingTaskDecorator());
-		executor.afterPropertiesSet();
-
-		executor.execute(runnable);
-
-		boolean finished = latch.await(10, TimeUnit.SECONDS);
-		assertThat(finished).isTrue();
-
-		assertThat(contextHolder.get()).isNotSameAs(securityContext);
-		assertThat(authHolder.get()).isSameAs(authA);
-
-		SecurityContext current = SecurityContextHolder.getContext();
-		assertThat(current).isSameAs(securityContext);
-		assertThat(current.getAuthentication()).isSameAs(authA);
-	}
-
 }
@@ -276,17 +276,16 @@ class InetAddressMatchersTests {
 		}

 		@ParameterizedTest
-		@ValueSource(strings = { "127.0.0.1", "127.0.0.255", "0.0.0.0" })
+		@ValueSource(strings = { "127.0.0.1", "127.0.0.255" })
 		void matchesWhenIpv4LoopbackThenReturnsTrue(String address) throws Exception {
 			InetAddressMatcher matcher = InetAddressMatchers.matchInternal().build();
 			assertThat(matcher.matches(InetAddress.getByName(address))).isTrue();
 		}

-		@ParameterizedTest
-		@ValueSource(strings = { "::1", "::" })
-		void matchesWhenIpv6LoopbackThenReturnsTrue(String address) throws Exception {
+		@Test
+		void matchesWhenIpv6LoopbackThenReturnsTrue() throws Exception {
 			InetAddressMatcher matcher = InetAddressMatchers.matchInternal().build();
-			assertThat(matcher.matches(InetAddress.getByName(address))).isTrue();
+			assertThat(matcher.matches(InetAddress.getByName("::1"))).isTrue();
 		}

 		@ParameterizedTest
@@ -416,12 +415,6 @@ class InetAddressMatchersTests {
 	@Nested
 	class ExternalInetAddressMatcherTests {

-		@Test
-		void matchesWhenInetAddressNullThenReturnsFalse() {
-			InetAddressMatcher matcher = InetAddressMatchers.matchExternal().build();
-			assertThat(matcher.matches((InetAddress) null)).isFalse();
-		}
-
 		@ParameterizedTest
 		@ValueSource(strings = { "8.8.8.8", "1.1.1.1" })
 		void matchesWhenIpv4PublicThenReturnsTrue(String address) throws Exception {
@@ -21,9 +21,6 @@ import java.nio.CharBuffer;
 import java.nio.charset.CharacterCodingException;
 import java.nio.charset.Charset;
 import java.nio.charset.StandardCharsets;
-import java.security.MessageDigest;
-
-import org.jspecify.annotations.Nullable;

 /**
 * UTF-8 Charset encoder/decoder.
@@ -69,21 +66,4 @@ public final class Utf8 {
 		}
 	}

-	/**
-	 * Constant time comparison to prevent against timing attacks.
-	 * @param expected the expected {@link CharSequence}
-	 * @param actual the actual {@link CharSequence}
-	 * @return true if {@code expected} and {@code actual} are equal, false otherwise
-	 * @since 5.7.26
-	 */
-	public static boolean isEqual(@Nullable CharSequence expected, @Nullable CharSequence actual) {
-		byte[] expectedBytes = bytesUtf8(expected);
-		byte[] actualBytes = bytesUtf8(actual);
-		return MessageDigest.isEqual(expectedBytes, actualBytes);
-	}
-
-	private static byte @Nullable [] bytesUtf8(@Nullable CharSequence s) {
-		return (s != null) ? Utf8.encode(s) : null;
-	}
-
 }
@@ -37,9 +37,7 @@ import org.springframework.security.crypto.util.EncodingUtils;
 *
 * @author Keith Donald
 * @author Dave Syer
- * @deprecated Use {@link AesCbcBytesEncryptor} or {@link AesGcmBytesEncryptor} instead.
 */
-@Deprecated
 public final class AesBytesEncryptor implements BytesEncryptor {

 	private final SecretKey secretKey;
@@ -1,165 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.crypto.encrypt;
-
-import java.util.Objects;
-
-import javax.crypto.Cipher;
-import javax.crypto.SecretKey;
-import javax.crypto.spec.IvParameterSpec;
-import javax.crypto.spec.PBEKeySpec;
-import javax.crypto.spec.SecretKeySpec;
-
-import org.springframework.security.crypto.codec.Hex;
-import org.springframework.security.crypto.keygen.BytesKeyGenerator;
-import org.springframework.security.crypto.keygen.KeyGenerators;
-import org.springframework.security.crypto.util.EncodingUtils;
-
-/**
- * {@link BytesEncryptor} that uses 256-bit AES/CBC/PKCS5Padding with a random 16-byte
- * initialization vector. The IV is prepended to the ciphertext on encrypt and stripped on
- * decrypt.
- *
- * <p>
- * Note that CBC mode provides confidentiality but <em>not</em> integrity or authenticity.
- * Applications that require authenticated encryption should prefer
- * {@link AesGcmBytesEncryptor}. See the <a href=
- * "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html">
- * OWASP Cryptographic Storage Cheat Sheet</a> for guidance on choosing a cipher mode.
- *
- * <p>
- * When key derivation is used via {@link #withPassword(String, CharSequence)}, the key is
- * derived using PBKDF2WithHmacSHA256 with {@code DEFAULT_PBKDF2_ITERATIONS} iterations
- * per the <a href=
- * "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html">
- * OWASP Password Storage Cheat Sheet</a>. Because derivation is intentionally expensive,
- * the encryptor instance should be created once and reused rather than constructed
- * per-operation.
- *
- * @author Josh Cummings
- * @since 5.7.26
- * @see AesGcmBytesEncryptor
- * @see AesBytesEncryptor
- */
-public final class AesCbcBytesEncryptor implements BytesEncryptor {
-
-	private static final String ALGORITHM = "AES/CBC/PKCS5Padding";
-
-	private static final int IV_LENGTH_BYTES = 16;
-
-	private static final int DEFAULT_PBKDF2_ITERATIONS = 600_000;
-
-	private final SecretKey secretKey;
-
-	private final Cipher encryptor;
-
-	private final Cipher decryptor;
-
-	private final BytesKeyGenerator ivGenerator;
-
-	private AesCbcBytesEncryptor(SecretKey secretKey, BytesKeyGenerator ivGenerator) {
-		this.secretKey = new SecretKeySpec(secretKey.getEncoded(), "AES");
-		this.encryptor = CipherUtils.newCipher(ALGORITHM);
-		this.decryptor = CipherUtils.newCipher(ALGORITHM);
-		this.ivGenerator = ivGenerator;
-	}
-
-	/**
-	 * Creates an encryptor that derives its key from the given password and hex-encoded
-	 * salt using PBKDF2WithHmacSHA1.
-	 * @param password the password value
-	 * @param salt the hex-encoded salt value
-	 */
-	public static Builder withPassword(String password, CharSequence salt) {
-		return new Builder(password, salt);
-	}
-
-	/**
-	 * Creates an encryptor using the supplied {@link SecretKey}.
-	 * @param secretKey the secret (symmetric) key
-	 */
-	public static Builder withSecretKey(SecretKey secretKey) {
-		return new Builder(secretKey);
-	}
-
-	@Override
-	public byte[] encrypt(byte[] bytes) {
-		synchronized (this.encryptor) {
-			byte[] iv = this.ivGenerator.generateKey();
-			CipherUtils.initCipher(this.encryptor, Cipher.ENCRYPT_MODE, this.secretKey, new IvParameterSpec(iv));
-			byte[] ciphertext = CipherUtils.doFinal(this.encryptor, bytes);
-			return EncodingUtils.concatenate(iv, ciphertext);
-		}
-	}
-
-	@Override
-	public byte[] decrypt(byte[] encryptedBytes) {
-		int ivLength = this.ivGenerator.getKeyLength();
-		byte[] iv = EncodingUtils.subArray(encryptedBytes, 0, ivLength);
-		byte[] ciphertext = EncodingUtils.subArray(encryptedBytes, ivLength, encryptedBytes.length);
-		synchronized (this.decryptor) {
-			CipherUtils.initCipher(this.decryptor, Cipher.DECRYPT_MODE, this.secretKey, new IvParameterSpec(iv));
-			return CipherUtils.doFinal(this.decryptor, ciphertext);
-		}
-	}
-
-	private static SecretKey deriveKey(String password, CharSequence salt) {
-		return CipherUtils.newSecretKey("PBKDF2WithHmacSHA256",
-				new PBEKeySpec(password.toCharArray(), Hex.decode(salt), DEFAULT_PBKDF2_ITERATIONS, 256));
-	}
-
-	/**
-	 * A Builder for {@link AesCbcBytesEncryptor}.
-	 */
-	public static final class Builder {
-
-		private final SecretKey secretKey;
-
-		private BytesKeyGenerator ivGenerator = KeyGenerators.secureRandom(IV_LENGTH_BYTES);
-
-		private Builder(SecretKey secretKey) {
-			this.secretKey = secretKey;
-		}
-
-		private Builder(String password, CharSequence salt) {
-			this.secretKey = deriveKey(password, salt);
-		}
-
-		/**
-		 * Sets the {@link BytesKeyGenerator} to use for generating the initialization
-		 * vector.
-		 * @param ivGenerator the {@link BytesKeyGenerator} to use for generating the
-		 * initialization vector
-		 * @return this builder
-		 */
-		public Builder ivGenerator(BytesKeyGenerator ivGenerator) {
-			Objects.requireNonNull(ivGenerator, "ivGenerator cannot be null");
-			this.ivGenerator = ivGenerator;
-			return this;
-		}
-
-		/**
-		 * Builds the {@link AesCbcBytesEncryptor}.
-		 * @return the {@link AesCbcBytesEncryptor}
-		 */
-		public AesCbcBytesEncryptor build() {
-			return new AesCbcBytesEncryptor(this.secretKey, this.ivGenerator);
-		}
-
-	}
-
-}
@@ -1,172 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.crypto.encrypt;
-
-import java.util.Objects;
-
-import javax.crypto.Cipher;
-import javax.crypto.SecretKey;
-import javax.crypto.spec.GCMParameterSpec;
-import javax.crypto.spec.PBEKeySpec;
-import javax.crypto.spec.SecretKeySpec;
-
-import org.springframework.security.crypto.codec.Hex;
-import org.springframework.security.crypto.keygen.BytesKeyGenerator;
-import org.springframework.security.crypto.keygen.KeyGenerators;
-import org.springframework.security.crypto.util.EncodingUtils;
-
-/**
- * {@link BytesEncryptor} that uses 256-bit AES/GCM/NoPadding with a random 16-byte
- * initialization vector and a 128-bit authentication tag. The IV is prepended to the
- * ciphertext on encrypt and stripped on decrypt. GCM provides authenticated encryption
- * (AEAD): both confidentiality and integrity are protected, and decryption throws if the
- * ciphertext has been tampered with.
- *
- * <p>
- * This class uses a 16-byte (128-bit) IV rather than the 12-byte (96-bit) IV recommended
- * by NIST SP 800-38D for GCM. Both lengths are cryptographically valid; the 16-byte
- * choice maintains consistency with the rest of the Spring Security crypto module. For
- * additional guidance, please see the <a href=
- * "https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html">
- * OWASP Cryptographic Storage Cheat Sheet</a>.
- *
- * <p>
- * When key derivation is used via {@link #withPassword(String, CharSequence)}, the key is
- * derived using PBKDF2WithHmacSHA256 with {@code DEFAULT_PBKDF2_ITERATIONS} iterations
- * per the <a href=
- * "https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html">
- * OWASP Password Storage Cheat Sheet</a>. Because derivation is intentionally expensive,
- * the encryptor instance should be created once and reused rather than constructed
- * per-operation.
- *
- * @author Josh Cummings
- * @since 5.7.26
- * @see AesCbcBytesEncryptor
- * @see AesBytesEncryptor
- */
-public final class AesGcmBytesEncryptor implements BytesEncryptor {
-
-	private static final String ALGORITHM = "AES/GCM/NoPadding";
-
-	private static final int IV_LENGTH_BYTES = 16;
-
-	private static final int TAG_LENGTH_BITS = 128;
-
-	private static final int DEFAULT_PBKDF2_ITERATIONS = 600_000;
-
-	private final SecretKey secretKey;
-
-	private final Cipher encryptor;
-
-	private final Cipher decryptor;
-
-	private final BytesKeyGenerator ivGenerator;
-
-	private AesGcmBytesEncryptor(SecretKey secretKey, BytesKeyGenerator ivGenerator) {
-		this.secretKey = new SecretKeySpec(secretKey.getEncoded(), "AES");
-		this.encryptor = CipherUtils.newCipher(ALGORITHM);
-		this.decryptor = CipherUtils.newCipher(ALGORITHM);
-		this.ivGenerator = ivGenerator;
-	}
-
-	/**
-	 * Creates an encryptor that derives its key from the given password and hex-encoded
-	 * salt using PBKDF2WithHmacSHA1.
-	 * @param password the password value
-	 * @param salt the hex-encoded salt value
-	 */
-	public static Builder withPassword(String password, CharSequence salt) {
-		return new Builder(password, salt);
-	}
-
-	/**
-	 * Creates an encryptor using the supplied {@link SecretKey}.
-	 * @param secretKey the secret (symmetric) key
-	 */
-	public static Builder withSecretKey(SecretKey secretKey) {
-		return new Builder(secretKey);
-	}
-
-	@Override
-	public byte[] encrypt(byte[] bytes) {
-		synchronized (this.encryptor) {
-			byte[] iv = this.ivGenerator.generateKey();
-			CipherUtils.initCipher(this.encryptor, Cipher.ENCRYPT_MODE, this.secretKey,
-					new GCMParameterSpec(TAG_LENGTH_BITS, iv));
-			byte[] ciphertext = CipherUtils.doFinal(this.encryptor, bytes);
-			return EncodingUtils.concatenate(iv, ciphertext);
-		}
-	}
-
-	@Override
-	public byte[] decrypt(byte[] encryptedBytes) {
-		int ivLength = this.ivGenerator.getKeyLength();
-		byte[] iv = EncodingUtils.subArray(encryptedBytes, 0, ivLength);
-		byte[] ciphertext = EncodingUtils.subArray(encryptedBytes, ivLength, encryptedBytes.length);
-		synchronized (this.decryptor) {
-			CipherUtils.initCipher(this.decryptor, Cipher.DECRYPT_MODE, this.secretKey,
-					new GCMParameterSpec(TAG_LENGTH_BITS, iv));
-			return CipherUtils.doFinal(this.decryptor, ciphertext);
-		}
-	}
-
-	private static SecretKey deriveKey(String password, CharSequence salt) {
-		return CipherUtils.newSecretKey("PBKDF2WithHmacSHA256",
-				new PBEKeySpec(password.toCharArray(), Hex.decode(salt), DEFAULT_PBKDF2_ITERATIONS, 256));
-	}
-
-	/**
-	 * A Builder for {@link AesGcmBytesEncryptor}.
-	 */
-	public static final class Builder {
-
-		private final SecretKey secretKey;
-
-		private BytesKeyGenerator ivGenerator = KeyGenerators.secureRandom(IV_LENGTH_BYTES);
-
-		private Builder(SecretKey secretKey) {
-			this.secretKey = secretKey;
-		}
-
-		private Builder(String password, CharSequence salt) {
-			this.secretKey = deriveKey(password, salt);
-		}
-
-		/**
-		 * Sets the {@link BytesKeyGenerator} to use for generating the initialization
-		 * vector.
-		 * @param ivGenerator the {@link BytesKeyGenerator} to use for generating the
-		 * initialization vector
-		 * @return this builder
-		 */
-		public Builder ivGenerator(BytesKeyGenerator ivGenerator) {
-			Objects.requireNonNull(ivGenerator, "ivGenerator cannot be null");
-			this.ivGenerator = ivGenerator;
-			return this;
-		}
-
-		/**
-		 * Builds the {@link AesGcmBytesEncryptor}.
-		 * @return the {@link AesGcmBytesEncryptor}
-		 */
-		public AesGcmBytesEncryptor build() {
-			return new AesGcmBytesEncryptor(this.secretKey, this.ivGenerator);
-		}
-
-	}
-
-}
@@ -16,6 +16,7 @@

 package org.springframework.security.crypto.encrypt;

+import org.springframework.security.crypto.encrypt.AesBytesEncryptor.CipherAlgorithm;
 import org.springframework.security.crypto.keygen.KeyGenerators;

 /**
@@ -41,14 +42,9 @@ public final class Encryptors {
 	 * not be shared
 	 * @param salt a hex-encoded, random, site-global salt value to use to generate the
 	 * key
-	 * @deprecated Use {@link AesGcmBytesEncryptor#withPassword(String, CharSequence)}
-	 * instead.
 	 */
-	@Deprecated
-	@SuppressWarnings("deprecation")
 	public static BytesEncryptor stronger(CharSequence password, CharSequence salt) {
-		return new AesBytesEncryptor(password.toString(), salt, KeyGenerators.secureRandom(16),
-				AesBytesEncryptor.CipherAlgorithm.GCM);
+		return new AesBytesEncryptor(password.toString(), salt, KeyGenerators.secureRandom(16), CipherAlgorithm.GCM);
 	}

 	/**
@@ -57,16 +53,18 @@ public final class Encryptors {
 	 * Function #2). Salts the password to prevent dictionary attacks against the key. The
 	 * provided salt is expected to be hex-encoded; it should be random and at least 8
 	 * bytes in length. Also applies a random 16-byte initialization vector to ensure each
-	 * encrypted message will be unique. Requires Java 6.
+	 * encrypted message will be unique. Requires Java 6. NOTE: This mode is not
+	 * <a href="https://en.wikipedia.org/wiki/Authenticated_encryption">authenticated</a>
+	 * and does not provide any guarantees about the authenticity of the data. For a more
+	 * secure alternative, users should prefer
+	 * {@link #stronger(CharSequence, CharSequence)}.
 	 * @param password the password used to generate the encryptor's secret key; should
 	 * not be shared
 	 * @param salt a hex-encoded, random, site-global salt value to use to generate the
 	 * key
-	 * @deprecated Use {@link AesCbcBytesEncryptor#withPassword(String, CharSequence)}
-	 * instead.
+	 *
+	 * @see Encryptors#stronger(CharSequence, CharSequence)
 	 */
-	@Deprecated
-	@SuppressWarnings("deprecation")
 	public static BytesEncryptor standard(CharSequence password, CharSequence salt) {
 		return new AesBytesEncryptor(password.toString(), salt, KeyGenerators.secureRandom(16));
 	}
@@ -76,12 +74,8 @@ public final class Encryptors {
 	 * text is hex-encoded.
 	 * @param password the password used to generate the encryptor's secret key; should
 	 * not be shared
-	 * @deprecated Use {@link AesGcmBytesEncryptor#withPassword(String, CharSequence)}
-	 * instead.
 	 * @see Encryptors#stronger(CharSequence, CharSequence)
 	 */
-	@Deprecated
-	@SuppressWarnings("deprecation")
 	public static TextEncryptor delux(CharSequence password, CharSequence salt) {
 		return new HexEncodingTextEncryptor(stronger(password, salt));
 	}
@@ -91,12 +85,8 @@ public final class Encryptors {
 	 * text is hex-encoded.
 	 * @param password the password used to generate the encryptor's secret key; should
 	 * not be shared
-	 * @deprecated Use {@link AesCbcBytesEncryptor#withPassword(String, CharSequence)}
-	 * instead.
 	 * @see Encryptors#standard(CharSequence, CharSequence)
 	 */
-	@Deprecated
-	@SuppressWarnings("deprecation")
 	public static TextEncryptor text(CharSequence password, CharSequence salt) {
 		return new HexEncodingTextEncryptor(standard(password, salt));
 	}
@@ -16,6 +16,8 @@

 package org.springframework.security.crypto.password;

+import java.security.MessageDigest;
+
 import org.jspecify.annotations.Nullable;

 import org.springframework.security.crypto.codec.Utf8;
@@ -37,7 +39,15 @@ final class PasswordEncoderUtils {
 	 * @return
 	 */
 	static boolean equals(String expected, @Nullable String actual) {
-		return Utf8.isEqual(expected, actual);
+		byte[] expectedBytes = bytesUtf8(expected);
+		byte[] actualBytes = bytesUtf8(actual);
+		return MessageDigest.isEqual(expectedBytes, actualBytes);
+	}
+
+	private static byte @Nullable [] bytesUtf8(@Nullable String s) {
+		// need to check if Utf8.encode() runs in constant time (probably not).
+		// This may leak length of string.
+		return (s != null) ? Utf8.encode(s) : null;
 	}

 }
@@ -24,7 +24,6 @@ import com.password4j.BalloonHashingFunction;
 import com.password4j.Hash;
 import com.password4j.Password;

-import org.springframework.security.crypto.codec.Utf8;
 import org.springframework.security.crypto.password.AbstractValidatingPasswordEncoder;
 import org.springframework.util.Assert;

@@ -141,7 +140,7 @@ public class BalloonHashingPassword4jPasswordEncoder extends AbstractValidatingP
 			String expectedHash = parts[1];

 			Hash hash = Password.hash(rawPassword).addSalt(salt).with(this.balloonHashingFunction);
-			return Utf8.isEqual(expectedHash, hash.getResult());
+			return expectedHash.equals(hash.getResult());
 		}
 		catch (IllegalArgumentException ex) {
 			// Invalid Base64 encoding
@@ -24,7 +24,6 @@ import com.password4j.Hash;
 import com.password4j.PBKDF2Function;
 import com.password4j.Password;

-import org.springframework.security.crypto.codec.Utf8;
 import org.springframework.security.crypto.password.AbstractValidatingPasswordEncoder;
 import org.springframework.util.Assert;

@@ -139,7 +138,7 @@ public class Pbkdf2Password4jPasswordEncoder extends AbstractValidatingPasswordE
 			String expectedHash = parts[1];

 			Hash hash = Password.hash(rawPassword).addSalt(salt).with(this.pbkdf2Function);
-			return Utf8.isEqual(expectedHash, hash.getResult());
+			return expectedHash.equals(hash.getResult());
 		}
 		catch (IllegalArgumentException ex) {
 			// Invalid Base64 encoding
@@ -37,48 +37,4 @@ public class Utf8Tests {
 		assertThat(decoded).isEqualTo("6048b75ed560785c");
 	}

-	@Test
-	public void isEqualWhenDifferentLengthThenFalse() {
-		assertThat(Utf8.isEqual("abc", "a")).isFalse();
-		assertThat(Utf8.isEqual("a", "abc")).isFalse();
-	}
-
-	@Test
-	public void isEqualWhenNullAndNotEmptyThenFalse() {
-		assertThat(Utf8.isEqual(null, "a")).isFalse();
-		assertThat(Utf8.isEqual("a", null)).isFalse();
-	}
-
-	@Test
-	public void isEqualWhenNullAndNullThenTrue() {
-		assertThat(Utf8.isEqual(null, null)).isTrue();
-	}
-
-	@Test
-	public void isEqualWhenNullAndEmptyThenFalse() {
-		assertThat(Utf8.isEqual(null, "")).isFalse();
-		assertThat(Utf8.isEqual("", null)).isFalse();
-	}
-
-	@Test
-	public void isEqualWhenNotEmptyAndEmptyThenFalse() {
-		assertThat(Utf8.isEqual("abc", "")).isFalse();
-		assertThat(Utf8.isEqual("", "abc")).isFalse();
-	}
-
-	@Test
-	public void isEqualWhenEmptyAndEmptyThenTrue() {
-		assertThat(Utf8.isEqual("", "")).isTrue();
-	}
-
-	@Test
-	public void isEqualWhenDifferentCaseThenFalse() {
-		assertThat(Utf8.isEqual("aBc", "abc")).isFalse();
-	}
-
-	@Test
-	public void isEqualWhenSameThenTrue() {
-		assertThat(Utf8.isEqual("abcdef", "abcdef")).isTrue();
-	}
-
 }
@@ -1,203 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.crypto.encrypt;
-
-import java.nio.charset.StandardCharsets;
-
-import javax.crypto.SecretKey;
-import javax.crypto.spec.PBEKeySpec;
-
-import org.junit.jupiter.api.Test;
-
-import org.springframework.security.crypto.codec.Hex;
-import org.springframework.security.crypto.keygen.BytesKeyGenerator;
-import org.springframework.security.crypto.keygen.KeyGenerators;
-import org.springframework.security.crypto.password.Pbkdf2PasswordEncoder.SecretKeyFactoryAlgorithm;
-import org.springframework.security.crypto.util.EncodingUtils;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatIllegalStateException;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-
-/**
- * Tests for {@link AesCbcBytesEncryptor}.
- */
-class AesCbcBytesEncryptorTests {
-
-	private final String secret = "value";
-
-	private final String password = "password";
-
-	private final String hexSalt = "deadbeef";
-
-	@Test
-	void roundtripWhenUsingPasswordAndSaltThenEncryptsAndDecrypts() {
-		CryptoAssumptions.assumeCBCJCE();
-		AesCbcBytesEncryptor encryptor = AesCbcBytesEncryptor.withPassword(this.password, this.hexSalt).build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	void roundtripWhenUsingSecretKeyThenEncryptsAndDecrypts() {
-		CryptoAssumptions.assumeCBCJCE();
-		PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
-		SecretKey secretKey = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
-		AesCbcBytesEncryptor encryptor = AesCbcBytesEncryptor.withSecretKey(secretKey).build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	void encryptWhenUsingMockIvThenProducesKnownCiphertext() {
-		CryptoAssumptions.assumeCBCJCE();
-		BytesKeyGenerator mockGenerator = mock(BytesKeyGenerator.class);
-		given(mockGenerator.generateKey()).willReturn(Hex.decode("4b0febebd439db7ca77153cb254520c3"));
-		given(mockGenerator.getKeyLength()).willReturn(16);
-		AesCbcBytesEncryptor encryptor = AesCbcBytesEncryptor.withPassword(this.password, this.hexSalt)
-			.ivGenerator(mockGenerator)
-			.build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(Hex.encode(encrypted)).isEqualTo("4b0febebd439db7ca77153cb254520c3b7232ac29355d07869433f1ecf55fe94");
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	void encryptProducesUniqueOutputAndIvIsPrePended() {
-		CryptoAssumptions.assumeCBCJCE();
-		AesCbcBytesEncryptor encryptor = AesCbcBytesEncryptor.withPassword(this.password, this.hexSalt).build();
-		byte[] first = encryptor.encrypt(this.secret.getBytes());
-		byte[] second = encryptor.encrypt(this.secret.getBytes());
-		assertThat(first).isNotEqualTo(second);
-		assertThat(first.length).isGreaterThan(16);
-	}
-
-	@Test
-	@SuppressWarnings("deprecation")
-	void migratesFromDeprecatedNullIvCbcToAesCbcBytesEncryptor() {
-		CryptoAssumptions.assumeCBCJCE();
-		AesBytesEncryptor deprecated = new AesBytesEncryptor(this.password, this.hexSalt);
-		byte[] encrypted = deprecated.encrypt(this.secret.getBytes());
-
-		AesCbcBytesEncryptor modern = AesCbcBytesEncryptor.withPassword(this.password, this.hexSalt).build();
-		BytesEncryptor migrating = new MigratingBytesEncryptor("{CBC}", modern, deprecated);
-
-		assertThat(new String(migrating.decrypt(encrypted))).isEqualTo(this.secret);
-
-		byte[] migrated = migrating.encrypt(this.secret.getBytes());
-		assertThat(migrated[0]).isEqualTo((byte) '{');
-		assertThat(migrated[1]).isEqualTo((byte) 'C');
-		assertThat(migrated[2]).isEqualTo((byte) 'B');
-		assertThat(migrated[3]).isEqualTo((byte) 'C');
-		assertThat(migrated[4]).isEqualTo((byte) '}');
-		assertThat(new String(migrating.decrypt(migrated))).isEqualTo(this.secret);
-	}
-
-	@Test
-	@SuppressWarnings("deprecation")
-	void withSecretWhenAesBytesEncryptorEncryptsThenDecrypts() {
-		CryptoAssumptions.assumeCBCJCE();
-		PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
-		SecretKey key = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
-		AesBytesEncryptor deprecated = new AesBytesEncryptor(key, KeyGenerators.secureRandom(16),
-				AesBytesEncryptor.CipherAlgorithm.CBC);
-		AesCbcBytesEncryptor encryptor = AesCbcBytesEncryptor.withSecretKey(key).build();
-		byte[] encrypted = deprecated.encrypt(this.secret.getBytes());
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	@SuppressWarnings("deprecation")
-	void aesBytesEncryptorWhenEncryptsThenAesCbcBytesEncryptorDecrypts() {
-		CryptoAssumptions.assumeCBCJCE();
-		PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
-		SecretKey key = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
-		AesCbcBytesEncryptor encryptor = AesCbcBytesEncryptor.withSecretKey(key).build();
-		AesBytesEncryptor deprecated = new AesBytesEncryptor(key, KeyGenerators.secureRandom(16),
-				AesBytesEncryptor.CipherAlgorithm.CBC);
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(new String(deprecated.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	void roundtripWhenUsingCustomIvGeneratorThenEncryptsAndDecrypts() {
-		CryptoAssumptions.assumeCBCJCE();
-		BytesKeyGenerator customIvGenerator = mock(BytesKeyGenerator.class);
-		given(customIvGenerator.generateKey()).willReturn(Hex.decode("4b0febebd439db7ca77153cb254520c3"));
-		given(customIvGenerator.getKeyLength()).willReturn(16);
-		AesCbcBytesEncryptor encryptor = AesCbcBytesEncryptor.withPassword(this.password, this.hexSalt)
-			.ivGenerator(customIvGenerator)
-			.build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	@SuppressWarnings("deprecation")
-	void withPasswordDerivesADifferentKeyThanAesBytesEncryptor() {
-		CryptoAssumptions.assumeCBCJCE();
-		AesBytesEncryptor deprecated = new AesBytesEncryptor(this.password, this.hexSalt,
-				KeyGenerators.secureRandom(16));
-		AesCbcBytesEncryptor encryptor = AesCbcBytesEncryptor.withPassword(this.password, this.hexSalt).build();
-		byte[] encrypted = deprecated.encrypt(this.secret.getBytes());
-		assertThatIllegalStateException().isThrownBy(() -> encryptor.decrypt(encrypted));
-	}
-
-	private static final class MigratingBytesEncryptor implements BytesEncryptor {
-
-		private final byte[] prefix;
-
-		private final BytesEncryptor write;
-
-		private final BytesEncryptor deprecated;
-
-		MigratingBytesEncryptor(String prefix, BytesEncryptor write, BytesEncryptor deprecated) {
-			this.prefix = prefix.getBytes(StandardCharsets.US_ASCII);
-			this.write = write;
-			this.deprecated = deprecated;
-		}
-
-		@Override
-		public byte[] encrypt(byte[] bytes) {
-			return EncodingUtils.concatenate(this.prefix, this.write.encrypt(bytes));
-		}
-
-		@Override
-		public byte[] decrypt(byte[] encryptedBytes) {
-			if (startsWith(encryptedBytes, this.prefix)) {
-				byte[] bytes = EncodingUtils.subArray(encryptedBytes, this.prefix.length, encryptedBytes.length);
-				return this.write.decrypt(bytes);
-			}
-			return this.deprecated.decrypt(encryptedBytes);
-		}
-
-		private static boolean startsWith(byte[] data, byte[] prefix) {
-			if (data.length < prefix.length) {
-				return false;
-			}
-			for (int i = 0; i < prefix.length; i++) {
-				if (data[i] != prefix[i]) {
-					return false;
-				}
-			}
-			return true;
-		}
-
-	}
-
-}
@@ -1,146 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.crypto.encrypt;
-
-import javax.crypto.SecretKey;
-import javax.crypto.spec.PBEKeySpec;
-
-import org.junit.jupiter.api.Test;
-
-import org.springframework.security.crypto.codec.Hex;
-import org.springframework.security.crypto.keygen.BytesKeyGenerator;
-import org.springframework.security.crypto.keygen.KeyGenerators;
-import org.springframework.security.crypto.password.Pbkdf2PasswordEncoder.SecretKeyFactoryAlgorithm;
-
-import static org.assertj.core.api.Assertions.assertThat;
-import static org.assertj.core.api.Assertions.assertThatIllegalStateException;
-import static org.mockito.BDDMockito.given;
-import static org.mockito.Mockito.mock;
-
-/**
- * Tests for {@link AesGcmBytesEncryptor}.
- */
-class AesGcmBytesEncryptorTests {
-
-	private final String secret = "value";
-
-	private final String password = "password";
-
-	private final String hexSalt = "deadbeef";
-
-	@Test
-	void roundtripWhenUsingPasswordAndSaltThenEncryptsAndDecrypts() {
-		CryptoAssumptions.assumeGCMJCE();
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withPassword(this.password, this.hexSalt).build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	void roundtripWhenUsingSecretKeyThenEncryptsAndDecrypts() {
-		CryptoAssumptions.assumeGCMJCE();
-		PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
-		SecretKey secretKey = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withSecretKey(secretKey).build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	void encryptWhenUsingMockIvThenProducesKnownCiphertext() {
-		CryptoAssumptions.assumeGCMJCE();
-		BytesKeyGenerator mockGenerator = mock(BytesKeyGenerator.class);
-		given(mockGenerator.generateKey()).willReturn(Hex.decode("4b0febebd439db7ca77153cb254520c3"));
-		given(mockGenerator.getKeyLength()).willReturn(16);
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withPassword(this.password, this.hexSalt)
-			.ivGenerator(mockGenerator)
-			.build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(Hex.encode(encrypted))
-			.isEqualTo("4b0febebd439db7ca77153cb254520c3e4d61ae38207b4e42b820d311dc3d4e0e2f37ed5ee");
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	void encryptProducesUniqueOutputAndIvIsPrepended() {
-		CryptoAssumptions.assumeGCMJCE();
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withPassword(this.password, this.hexSalt).build();
-		byte[] first = encryptor.encrypt(this.secret.getBytes());
-		byte[] second = encryptor.encrypt(this.secret.getBytes());
-		assertThat(first).isNotEqualTo(second);
-		assertThat(first.length).isGreaterThan(32);
-	}
-
-	@Test
-	@SuppressWarnings("deprecation")
-	void withSecretWhenAesBytesEncryptorEncryptsThenDecrypts() {
-		CryptoAssumptions.assumeGCMJCE();
-		PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
-		SecretKey key = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
-		AesBytesEncryptor deprecated = new AesBytesEncryptor(key, KeyGenerators.secureRandom(16),
-				AesBytesEncryptor.CipherAlgorithm.GCM);
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withSecretKey(key).build();
-		byte[] encrypted = deprecated.encrypt(this.secret.getBytes());
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	@SuppressWarnings("deprecation")
-	void aesBytesEncryptorWhenEncryptsThenAesGcmBytesEncryptorDecrypts() {
-		CryptoAssumptions.assumeGCMJCE();
-		PBEKeySpec keySpec = new PBEKeySpec(this.password.toCharArray(), Hex.decode(this.hexSalt), 1024, 256);
-		SecretKey key = CipherUtils.newSecretKey(SecretKeyFactoryAlgorithm.PBKDF2WithHmacSHA1.name(), keySpec);
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withSecretKey(key)
-			.ivGenerator(KeyGenerators.secureRandom(12))
-			.build();
-		AesBytesEncryptor deprecated = new AesBytesEncryptor(key, KeyGenerators.secureRandom(12),
-				AesBytesEncryptor.CipherAlgorithm.GCM);
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(new String(deprecated.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	void roundtripWhenUsingCustomIvGeneratorLengthThenEncryptsAndDecrypts() {
-		CryptoAssumptions.assumeGCMJCE();
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withPassword(this.password, this.hexSalt)
-			.ivGenerator(KeyGenerators.secureRandom(12))
-			.build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		assertThat(new String(encryptor.decrypt(encrypted))).isEqualTo(this.secret);
-	}
-
-	@Test
-	@SuppressWarnings("deprecation")
-	void withPasswordDerivesADifferentKeyThanAesBytesEncryptor() {
-		CryptoAssumptions.assumeGCMJCE();
-		AesBytesEncryptor deprecated = new AesBytesEncryptor(this.password, this.hexSalt,
-				KeyGenerators.secureRandom(16), AesBytesEncryptor.CipherAlgorithm.GCM);
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withPassword(this.password, this.hexSalt).build();
-		byte[] encrypted = deprecated.encrypt(this.secret.getBytes());
-		assertThatIllegalStateException().isThrownBy(() -> encryptor.decrypt(encrypted));
-	}
-
-	@Test
-	void decryptDetectsAuthenticationTagTampering() {
-		CryptoAssumptions.assumeGCMJCE();
-		AesGcmBytesEncryptor encryptor = AesGcmBytesEncryptor.withPassword(this.password, this.hexSalt).build();
-		byte[] encrypted = encryptor.encrypt(this.secret.getBytes());
-		encrypted[17] ^= 0xFF;
-		assertThatIllegalStateException().isThrownBy(() -> encryptor.decrypt(encrypted));
-	}
-
-}
@@ -24,23 +24,25 @@ import javax.crypto.NoSuchPaddingException;
 import org.junit.jupiter.api.Assumptions;
 import org.opentest4j.TestAbortedException;

+import org.springframework.security.crypto.encrypt.AesBytesEncryptor.CipherAlgorithm;
+
 public final class CryptoAssumptions {

 	private CryptoAssumptions() {
 	}

 	public static void assumeGCMJCE() {
-		assumeAes256("GCM");
+		assumeAes256(CipherAlgorithm.GCM);
 	}

 	public static void assumeCBCJCE() {
-		assumeAes256("CBC");
+		assumeAes256(CipherAlgorithm.CBC);
 	}

-	private static void assumeAes256(String cipherAlgorithm) {
+	private static void assumeAes256(CipherAlgorithm cipherAlgorithm) {
 		boolean aes256Available = false;
 		try {
-			Cipher.getInstance(cipherAlgorithm);
+			Cipher.getInstance(cipherAlgorithm.toString());
 			aes256Available = Cipher.getMaxAllowedKeyLength("AES") >= 256;
 		}
 		catch (NoSuchAlgorithmException ex) {
@@ -8,8 +8,8 @@ The code is distributed as part of the core module but has no dependencies on an

 [[spring-security-crypto-encryption]]
 == Encryptors
-Spring Security provides javadoc:org.springframework.security.crypto.encrypt.AesGcmBytesEncryptor[] and javadoc:org.springframework.security.crypto.encrypt.AesCbcBytesEncryptor[] for constructing symmetric encryptors.
-These can be used to encrypt data in raw `byte[]` form.
+The javadoc:org.springframework.security.crypto.encrypt.Encryptors[] class provides factory methods for constructing symmetric encryptors.
+This class lets you create javadoc:org.springframework.security.crypto.encrypt.BytesEncryptor[] instances to encrypt data in raw `byte[]` form.
 You can also construct javadoc:org.springframework.security.crypto.encrypt.TextEncryptor[] instances to encrypt text strings.
 Encryptors are thread-safe.

@@ -20,7 +20,7 @@ Both `BytesEncryptor` and `TextEncryptor` are interfaces. `BytesEncryptor` has m

 [[spring-security-crypto-encryption-bytes]]
 === BytesEncryptor
-Use `AesGcmBytesEncryptor` to construct a BytesEncryptor with authenticated encryption:
+You can use the `Encryptors.stronger` factory method to construct a `BytesEncryptor`:

 .BytesEncryptor
 [tabs]
@@ -29,22 +29,24 @@ Java::
 +
 [source,java,role="primary"]
 ----
-AesGcmBytesEncryptor.withPassword("password", "salt").build();
+Encryptors.stronger("password", "salt");
 ----

 Kotlin::
 +
 [source,kotlin,role="secondary"]
 ----
-AesGcmBytesEncryptor.withPassword("password", "salt").build()
+Encryptors.stronger("password", "salt")
 ----
 ======

-`AesGcmBytesEncryptor` uses 256-bit AES encryption with Galois Counter Mode (GCM), providing https://en.wikipedia.org/wiki/Authenticated_encryption[authenticated encryption] (AEAD).
-It derives the secret key using PKCS #5's PBKDF2 (Password-Based Key Derivation Function #2).
-The password used to generate the SecretKey should be kept in a secure place and not be shared.
-The salt is used to prevent dictionary attacks against the key in the event your encrypted data is compromised.
-A 16-byte random initialization vector is also applied so each encrypted message is unique.
+The `stronger` encryption method creates an encryptor by using 256-bit AES encryption with
+Galois Counter Mode (GCM).
+It derives the secret key by using PKCS #5's PBKDF2 (Password-Based Key Derivation Function #2).
+This method requires Java 6.
+The password used to generate the `SecretKey` should be kept in a secure place and should not be shared.
+The salt is used to prevent dictionary attacks against the key in the event that your encrypted data is compromised.
+A 16-byte random initialization vector is also applied so that each encrypted message is unique.

 The provided salt should be in hex-encoded String form, be random, and be at least 8 bytes in length.
 You can generate such a salt by using a `KeyGenerator`:
@@ -67,33 +69,14 @@ val salt = KeyGenerators.string().generateKey() // generates a random 8-byte sal
 ----
 ======

-Users who require CBC mode may use `AesCbcBytesEncryptor`:
-
-.AesCbcBytesEncryptor
-[tabs]
-======
-Java::
-+
-[source,java,role="primary"]
----
-AesCbcBytesEncryptor.withPassword("password", "salt").build();
----
-
-Kotlin::
-+
-[source,kotlin,role="secondary"]
----
-AesCbcBytesEncryptor.withPassword("password", "salt").build()
----
-======
-
+You can also use the `standard` encryption method, which is 256-bit AES in Cipher Block Chaining (CBC) Mode.
 This mode is not https://en.wikipedia.org/wiki/Authenticated_encryption[authenticated] and does not provide any
 guarantees about the authenticity of the data.
-For a more secure alternative, users should prefer `AesGcmBytesEncryptor`.
+For a more secure alternative, use `Encryptors.stronger`.

 [[spring-security-crypto-encryption-text]]
 === TextEncryptor
-Use `AesCbcBytesEncryptor` to encrypt text data:
+You can use the `Encryptors.text` factory method to construct a standard TextEncryptor:

 .TextEncryptor
 [tabs]
@@ -102,22 +85,19 @@ Java::
 +
 [source,java,role="primary"]
 ----
-AesCbcBytesEncryptor.withPassword("password", "salt").build();
+Encryptors.text("password", "salt");
 ----

 Kotlin::
 +
 [source,kotlin,role="secondary"]
 ----
-AesCbcBytesEncryptor.withPassword("password", "salt").build()
+Encryptors.text("password", "salt")
 ----
 ======

-`AesCbcBytesEncryptor` encrypts data as raw bytes.
-You can hex-encode the result for easy storage on the filesystem or in the database.
-
-NOTE: Queryable text encryption (encrypting such that the same plaintext always produces the same ciphertext) is no longer recommended, as it relies on a fixed initialization vector and does not provide adequate security.
-Instead, look to your data store for a mechanism to query encrypted data.
+A `TextEncryptor` uses a standard `BytesEncryptor` to encrypt text data.
+Encrypted results are returned as hex-encoded strings for easy storage on the filesystem or in a database.

 [[spring-security-crypto-keygenerators]]
 == Key Generators
@@ -54,13 +54,138 @@ Therefore, a custom javadoc:org.springframework.security.web.server.authenticati
 One of the most common delivery strategies is a Magic Link, via e-mail, SMS, etc.
 In the following example, we are going to create a magic link and sent it to the user's email.

-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.One-Time Token Login Configuration
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+}
+
+import org.springframework.mail.SimpleMailMessage;
+import org.springframework.mail.javamail.JavaMailSender;
+
+@Component <1>
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+
+    private final MailSender mailSender;
+
+    private final ServerOneTimeTokenGenerationSuccessHandler redirectHandler = new ServerRedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");
+
+    // constructor omitted
+
+    @Override
+    public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
+        return Mono.just(exchange.getRequest())
+				.map((request) ->
+					UriComponentsBuilder.fromUri(request.getURI())
+						.replacePath(request.getPath().contextPath().value())
+						.replaceQuery(null)
+						.fragment(null)
+						.path("/login/ott")
+						.queryParam("token", oneTimeToken.getTokenValue())
+						.toUriString() <2>
+					)
+			.flatMap((uri) -> this.mailSender.send(getUserEmail(oneTimeToken.getUsername()), <3>
+					"Use the following link to sign in into the application: " + magicLink)) <4>
+			.then(this.redirectHandler.handle(exchange, oneTimeToken)); <5>
+    }
+
+    private String getUserEmail() {
+        // ...
+    }
+
+}
+
+@Controller
+class PageController {
+
+    @GetMapping("/ott/sent")
+    String ottSent() {
+        return "my-template";
+    }
+
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                authorizeExchange {
+                    authorize(anyExchange, authenticated)
+                 }
+                 oneTimeTokenLogin { }
+             }
+         }
+
+}
+
+@Component (1)
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+
+    private val redirectStrategy: ServerRedirectStrategy = DefaultServerRedirectStrategy()
+
+    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
+        val builder = UriComponentsBuilder.fromUri(exchange.request.uri)
+            .replacePath(null)
+            .replaceQuery(null)
+            .fragment(null)
+            .path("/login/ott")
+            .queryParam("token", oneTimeToken.getTokenValue()) (2)
+        val magicLink = builder.toUriString()
+        builder.replacePath(null)
+            .replaceQuery(null)
+            .path("/ott/sent")
+        val redirectLink = builder.toUriString()
+        return this.mailSender.send(
+            getUserEmail(oneTimeToken.getUsername()), (3)
+            "Use the following link to sign in into the application: $magicLink") (4)
+        .then(this.redirectStrategy.sendRedirect(exchange, URI.create(redirectLink))) (5)
+    }
+
+        private String getUserEmail() {
+            // ...
+        }
+}
+
+@Controller
+class PageController {
+
+    @GetMapping("/ott/sent")
+    fun ottSent(): String {
+        return "my-template"
+    }
+}
+
+----
+======
+
 <1> Make the `MagicLinkOneTimeTokenGenerationSuccessHandler` a Spring bean
 <2> Create a login processing URL with the `token` as a query param
 <3> Retrieve the user's email based on the username
 <4> Use the `MailSender` API to send the email to the user with the magic link
-<5> Use the `ServerOneTimeTokenGenerationSuccessHandler` to perform a redirect to your desired URL
+<5> Use the `ServerRedirectStrategy` to perform a redirect to your desired URL

 The email content will look similar to:

@@ -72,10 +197,65 @@ The default submit page will detect that the URL has the `token` query param and
 == Changing the One-Time Token Generate URL

 By default, the javadoc:org.springframework.security.web.server.authentication.ott.GenerateOneTimeTokenWebFilter[] listens to `POST /ott/generate` requests.
-That URL can be changed by using the `tokenGeneratingUrl(String)` DSL method:
+That URL can be changed by using the `generateTokenUrl(String)` DSL method:

-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Changing the Generate URL
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .generateTokenUrl("/ott/my-generate-url")
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                 // ...
+                 formLogin { }
+                 oneTimeTokenLogin {
+                    generateTokenUrl = "/ott/my-generate-url"
+                 }
+             }
+         }
+
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======

 [[changing-submit-page-url]]
 == Changing the Default Submit Page URL
@@ -83,17 +263,151 @@ include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent
 The default One-Time Token submit page is generated by the javadoc:org.springframework.security.web.server.ui.OneTimeTokenSubmitPageGeneratingWebFilter[] and listens to `GET /login/ott`.
 The URL can also be changed, like so:

-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Configuring the Default Submit Page URL
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .submitPageUrl("/ott/submit")
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                 // ...
+                 formLogin { }
+                 oneTimeTokenLogin {
+                    submitPageUrl = "/ott/submit"
+                 }
+             }
+         }
+
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======

 [[disabling-default-submit-page]]
 == Disabling the Default Submit Page

 If you want to use your own One-Time Token submit page, you can disable the default page and then provide your own endpoint.

-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
-include-code::./MyController[tag=snippet,indent=0]
+.Disabling the Default Submit Page
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            .authorizeExchange((authorize) -> authorize
+                .pathMatchers("/my-ott-submit").permitAll()
+                .anyExchange().authenticated()
+            )
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .showDefaultSubmitPage(false)
+            );
+        return http.build();
+    }
+
+}
+
+@Controller
+public class MyController {
+
+    @GetMapping("/my-ott-submit")
+    public String ottSubmitPage() {
+        return "my-ott-submit";
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                authorizeExchange {
+                    authorize(pathMatchers("/my-ott-submit"), permitAll)
+                    authorize(anyExchange, authenticated)
+                 }
+                 .formLogin { }
+                 oneTimeTokenLogin {
+                    showDefaultSubmitPage = false
+                 }
+             }
+         }
+
+}
+
+@Controller
+class MyController {
+
+    @GetMapping("/my-ott-submit")
+    fun ottSubmitPage(): String {
+        return "my-ott-submit"
+    }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======

 [[customize-generate-consume-token]]
 == Customize How to Generate and Consume One-Time Tokens
@@ -111,21 +425,160 @@ Some of the most common reasons to customize the `ReactiveOneTimeTokenService` a
 There are two options to customize the `ReactiveOneTimeTokenService`.
 One option is to provide it as a bean, so it can be automatically be picked-up by the `oneTimeTokenLogin()` DSL:

-include-code::./OneTimeTokenServiceBeanSecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Passing the ReactiveOneTimeTokenService as a Bean
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+    @Bean
+    public ReactiveOneTimeTokenService oneTimeTokenService() {
+        return new MyCustomReactiveOneTimeTokenService();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                 //..
+                 .formLogin { }
+                 oneTimeTokenLogin { }
+             }
+         }
+
+         @Bean
+         open fun oneTimeTokenService():ReactiveOneTimeTokenService {
+             return MyCustomReactiveOneTimeTokenService();
+         }
+
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======

 The second option is to pass the `ReactiveOneTimeTokenService` instance to the DSL, which is useful if there are multiple ``SecurityWebFilterChain``s and a different ``ReactiveOneTimeTokenService``s is needed for each of them.

-include-code::./OneTimeTokenServiceDSLSecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Passing the ReactiveOneTimeTokenService using the DSL
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .oneTimeTokenService(new MyCustomReactiveOneTimeTokenService())
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebFluxSecurity
+class SecurityConfig {
+
+         open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
+             return http {
+                 //..
+                 .formLogin { }
+                 oneTimeTokenLogin {
+                    oneTimeTokenService = MyCustomReactiveOneTimeTokenService()
+                 }
+             }
+         }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender): ServerOneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+
+----
+======

 [[customize-generate-token-request]]
 == Customize GenerateOneTimeTokenRequest Instance
 There are a number of reasons that you may want to adjust an GenerateOneTimeTokenRequest. For example, you may want expiresIn to be set to 10 mins, which Spring Security sets to 5 mins by default.

-You can customize elements of GenerateOneTimeTokenRequest by publishing an ServerGenerateOneTimeTokenRequestResolver as a `@Bean`, like so:
+You can customize elements of GenerateOneTimeTokenRequest by publishing an ServerGenerateOneTimeTokenRequestResolver as a @Bean, like so:
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Bean
+ServerGenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
+    DefaultServerGenerateOneTimeTokenRequestResolver resolver = new DefaultServerGenerateOneTimeTokenRequestResolver();
+    resolver.setExpiresIn(Duration.ofSeconds(600));
+    return resolver;
+}
+----

-include-code::./SecurityConfig[tag=config,indent=0]
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun generateOneTimeTokenRequestResolver() : ServerGenerateOneTimeTokenRequestResolver {
+    return DefaultServerGenerateOneTimeTokenRequestResolver().apply {
+        this.setExpiresIn(Duration.ofMinutes(10))
+    }
+}
+----
+======

 [[validating-account-status]]
 == Validating Account Status
@@ -54,12 +54,133 @@ Therefore, a custom javadoc:org.springframework.security.web.authentication.ott.
 One of the most common delivery strategies is a Magic Link, via e-mail, SMS, etc.
 In the following example, we are going to create a magic link and sent it to the user's email.

-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.One-Time Token Login Configuration
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+}
+
+import org.springframework.mail.SimpleMailMessage;
+import org.springframework.mail.javamail.JavaMailSender;
+
+@Component <1>
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+
+    private final MailSender mailSender;
+
+    private final OneTimeTokenGenerationSuccessHandler redirectHandler = new RedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");
+
+    // constructor omitted
+
+    @Override
+    public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException {
+        UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(request.getRequestURL().toString())
+                .replacePath(request.getContextPath())
+                .replaceQuery(null)
+                .fragment(null)
+                .path("/login/ott")
+                .queryParam("token", oneTimeToken.getTokenValue()); <2>
+        String magicLink = builder.toUriString();
+        String email = getUserEmail(oneTimeToken.getUsername()); <3>
+        this.mailSender.send(email, "Your Spring Security One Time Token", "Use the following link to sign in into the application: " + magicLink); <4>
+        this.redirectHandler.handle(request, response, oneTimeToken); <5>
+    }
+
+    private String getUserEmail() {
+        // ...
+    }
+
+}
+
+@Controller
+class PageController {
+
+    @GetMapping("/ott/sent")
+    String ottSent() {
+        return "my-template";
+    }
+
+}
+
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+        @Bean
+        open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+            http{
+                formLogin {}
+                oneTimeTokenLogin {  }
+            }
+            return http.build()
+        }
+}
+
+import org.springframework.mail.SimpleMailMessage;
+import org.springframework.mail.javamail.JavaMailSender;
+
+@Component (1)
+class MagicLinkOneTimeTokenGenerationSuccessHandler(
+    private val mailSender: MailSender,
+    private val redirectHandler: OneTimeTokenGenerationSuccessHandler = RedirectOneTimeTokenGenerationSuccessHandler("/ott/sent")
+) : OneTimeTokenGenerationSuccessHandler {
+
+    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
+        val builder = UriComponentsBuilder.fromUriString(request.getRequestURL().toString())
+            .replacePath(request.contextPath)
+            .replaceQuery(null)
+            .fragment(null)
+            .path("/login/ott")
+            .queryParam("token", oneTimeToken.getTokenValue()) (2)
+        val magicLink = builder.toUriString()
+        val email = getUserEmail(oneTimeToken.getUsername()) (3)
+        this.mailSender.send(email, "Your Spring Security One Time Token", "Use the following link to sign in into the application: $magicLink")(4)
+        this.redirectHandler.handle(request, response, oneTimeToken) (5)
+    }
+
+    private fun getUserEmail(): String {
+        // ...
+    }
+}
+
+@Controller
+class PageController {
+
+    @GetMapping("/ott/sent")
+    fun ottSent(): String {
+        return "my-template"
+    }
+}
+
+----
+======
+
 <1> Make the `MagicLinkOneTimeTokenGenerationSuccessHandler` a Spring bean
 <2> Create a login processing URL with the `token` as a query param
 <3> Retrieve the user's email based on the username
-<4> Use the `MailSender` API to send the email to the user with the magic link
+<4> Use the `JavaMailSender` API to send the email to the user with the magic link
 <5> Use the `RedirectOneTimeTokenGenerationSuccessHandler` to perform a redirect to your desired URL

 The email content will look similar to:
@@ -72,15 +193,70 @@ The default submit page will detect that the URL has the `token` query param and
 == Changing the One-Time Token Generate URL

 By default, the javadoc:org.springframework.security.web.authentication.ott.GenerateOneTimeTokenFilter[] listens to `POST /ott/generate` requests.
-That URL can be changed by using the `tokenGeneratingUrl(String)` DSL method:
+That URL can be changed by using the `generateTokenUrl(String)` DSL method:

-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Changing the Generate URL
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .tokenGeneratingUrl("/ott/my-generate-url")
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+        @Bean
+        open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+            http {
+                //...
+                formLogin { }
+                oneTimeTokenLogin {
+                    tokenGeneratingUrl = "/ott/my-generate-url"
+                }
+            }
+            return http.build()
+        }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======

 [NOTE]
 ====
-The URI passed to `tokenGeneratingUrl` is matched literally.
-If you want it to live under your application servlet's base path, include that prefix explicitly — for example, `tokenGeneratingUrl("/api/ott/generate")`.
+The URI passed to `generateTokenUrl` is matched literally.
+If you want it to live under your application servlet's base path, include that prefix explicitly — for example, `generateTokenUrl("/api/ott/generate")`.
 The same applies to `loginProcessingUrl` and `tokenGeneratingUrl` elsewhere on this page.
 ====

@@ -90,17 +266,151 @@ The same applies to `loginProcessingUrl` and `tokenGeneratingUrl` elsewhere on t
 The default One-Time Token submit page is generated by the javadoc:org.springframework.security.web.authentication.ui.DefaultOneTimeTokenSubmitPageGeneratingFilter[] and listens to `GET /login/ott`.
 The URL can also be changed, like so:

-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Configuring the Default Submit Page URL
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .defaultSubmitPageUrl("/ott/submit")
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+        @Bean
+        open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+            http {
+                //...
+                formLogin { }
+                oneTimeTokenLogin {
+                    defaultSubmitPageUrl = "/ott/submit"
+                }
+            }
+            return http.build()
+        }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======

 [[disabling-default-submit-page]]
 == Disabling the Default Submit Page

 If you want to use your own One-Time Token submit page, you can disable the default page and then provide your own endpoint.

-include-code::./SecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
-include-code::./MyController[tag=snippet,indent=0]
+.Disabling the Default Submit Page
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            .authorizeHttpRequests((authorize) -> authorize
+                .requestMatchers("/my-ott-submit").permitAll()
+                .anyRequest().authenticated()
+            )
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .showDefaultSubmitPage(false)
+            );
+        return http.build();
+    }
+
+}
+
+@Controller
+public class MyController {
+
+    @GetMapping("/my-ott-submit")
+    public String ottSubmitPage() {
+        return "my-ott-submit";
+    }
+
+}
+
+@Component
+public class OneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+   @Bean
+   open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+            http {
+                authorizeHttpRequests {
+                    authorize("/my-ott-submit", authenticated)
+                    authorize(anyRequest, authenticated)
+                }
+                formLogin { }
+                oneTimeTokenLogin {
+                    showDefaultSubmitPage = false
+                }
+            }
+            return http.build()
+    }
+}
+
+@Controller
+class MyController {
+
+   @GetMapping("/my-ott-submit")
+   fun ottSubmitPage(): String {
+       return "my-ott-submit"
+   }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======

 [[customize-generate-consume-token]]
 == Customize How to Generate and Consume One-Time Tokens
@@ -119,21 +429,164 @@ Some of the most common reasons to customize the `OneTimeTokenService` are, but
 There are two options to customize the `OneTimeTokenService`.
 One option is to provide it as a bean, so it can be automatically be picked-up by the `oneTimeTokenLogin()` DSL:

-include-code::./OneTimeTokenServiceBeanSecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Passing the OneTimeTokenService as a Bean
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin(Customizer.withDefaults());
+        return http.build();
+    }
+
+    @Bean
+    public OneTimeTokenService oneTimeTokenService() {
+        return new MyCustomOneTimeTokenService();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+    @Bean
+    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+        http {
+            //...
+            formLogin { }
+            oneTimeTokenLogin { }
+        }
+        return http.build()
+    }
+
+    @Bean
+    open fun oneTimeTokenService(): OneTimeTokenService {
+        return MyCustomOneTimeTokenService()
+    }
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======

 The second option is to pass the `OneTimeTokenService` instance to the DSL, which is useful if there are multiple `SecurityFilterChain` and a different `OneTimeTokenService` is needed for each of them.

-include-code::./OneTimeTokenServiceDSLSecurityConfig[tag=config,indent=0]
-include-code::./MagicLinkOneTimeTokenGenerationSuccessHandler[tag=snippet,indent=0]
+.Passing the OneTimeTokenService using the DSL
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Configuration
+@EnableWebSecurity
+public class SecurityConfig {
+
+    @Bean
+    public SecurityFilterChain filterChain(HttpSecurity http) {
+        http
+            // ...
+            .formLogin(Customizer.withDefaults())
+            .oneTimeTokenLogin((ott) -> ott
+                .oneTimeTokenService(new MyCustomOneTimeTokenService())
+            );
+        return http.build();
+    }
+
+}
+
+@Component
+public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
+    // ...
+}
+----
+
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Configuration
+@EnableWebSecurity
+class SecurityConfig {
+
+    @Bean
+    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
+        http {
+            //...
+            formLogin { }
+            oneTimeTokenLogin {
+                oneTimeTokenService = MyCustomOneTimeTokenService()
+            }
+        }
+        return http.build()
+    }
+
+}
+
+@Component
+class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
+     // ...
+}
+----
+======

 [[customize-generate-token-request]]
 == Customize GenerateOneTimeTokenRequest Instance
 There are a number of reasons that you may want to adjust an GenerateOneTimeTokenRequest. For example, you may want expiresIn to be set to 10 mins, which Spring Security sets to 5 mins by default.

-You can customize elements of GenerateOneTimeTokenRequest by publishing an GenerateOneTimeTokenRequestResolver as a `@Bean`, like so:
+You can customize elements of GenerateOneTimeTokenRequest by publishing an GenerateOneTimeTokenRequestResolver as a @Bean, like so:
+[tabs]
+======
+Java::
+
+[source,java,role="primary"]
+----
+@Bean
+GenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
+    DefaultGenerateOneTimeTokenRequestResolver delegate = new DefaultGenerateOneTimeTokenRequestResolver();
+        return (request) -> {
+		    GenerateOneTimeTokenRequest generate = delegate.resolve(request);
+		    return new GenerateOneTimeTokenRequest(generate.getUsername(), Duration.ofSeconds(600));
+	};
+}
+----

-include-code::./SecurityConfig[tag=config,indent=0]
+Kotlin::
+
+[source,kotlin,role="secondary"]
+----
+@Bean
+fun generateRequestResolver() : GenerateOneTimeTokenRequestResolver {
+    return DefaultGenerateOneTimeTokenRequestResolver().apply {
+        this.setExpiresIn(Duration.ofMinutes(10))
+    }
+}
+----
+======

 [[validating-account-status]]
 == Validating Account Status
@@ -8,8 +8,3 @@
 == Web

 * Since Spring Framework's `HttpMethod#valueOf` now normalizes casing, `StrictServerWebExchangeFirewall` no longer detects a non-canonical-case HTTP method (for example, `get` instead of `GET`) as a distinct value; such requests are processed as the canonical method instead of being rejected. Applications with a customized `ServerExchangeRejectedHandler` should be aware it is no longer invoked for this case.
-
-== OAuth 2.0
-
-* https://github.com/spring-projects/spring-security/pull/18895[gh-18895] - Add `authenticationSuccessHandler` to the Reactive Resource Server DSL
-
@@ -1,6 +1,6 @@
 {
  "dependencies": {
-    "antora": "3.2.0-rc.3",
+    "antora": "3.2.0-rc.2",
    "@antora/atlas-extension": "1.0.0-alpha.5",
    "@antora/collector-extension": "1.0.3",
    "@asciidoctor/tabs": "1.0.0-beta.6",
@@ -49,7 +49,6 @@ dependencies {
 	testImplementation 'org.springframework:spring-websocket'

 	testImplementation 'org.springframework:spring-webmvc'
-	testImplementation 'org.springframework:spring-context-support'
 	testImplementation 'jakarta.servlet:jakarta.servlet-api'
 	testImplementation 'io.mockk:mockk'
 	testImplementation "org.junit.jupiter:junit-jupiter-api"
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.changinggenerateurl;
-
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-		/**/ return Mono.empty();
-	}
-
-}
-// end::snippet[]
@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.changinggenerateurl;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.tokenGeneratingUrl("/ott/my-generate-url")
-			);
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.changingsubmitpageurl;
-
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-		/**/ return Mono.empty();
-	}
-
-}
-// end::snippet[]
@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.changingsubmitpageurl;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.defaultSubmitPageUrl("/ott/submit")
-			);
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
-
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-		/**/ return Mono.empty();
-	}
-
-}
-// end::snippet[]
@@ -1,38 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
-
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
-import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService;
-import reactor.core.publisher.Mono;
-
-class MyCustomReactiveOneTimeTokenService implements ReactiveOneTimeTokenService {
-
-
-	@Override
-	public Mono<OneTimeToken> generate(GenerateOneTimeTokenRequest request) {
-		return null;
-	}
-
-	@Override
-	public Mono<OneTimeToken> consume(OneTimeTokenAuthenticationToken authenticationToken) {
-		return null;
-	}
-
-}
@@ -1,48 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken.MyCustomReactiveOneTimeTokenService;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class OneTimeTokenServiceBeanSecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin(Customizer.withDefaults());
-		return http.build();
-	}
-
-	@Bean
-	public ReactiveOneTimeTokenService oneTimeTokenService() {
-		return new MyCustomReactiveOneTimeTokenService();
-	}
-
-}
-// end::config[]
@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegenerateconsumetoken;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class OneTimeTokenServiceDSLSecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.tokenService(new MyCustomReactiveOneTimeTokenService())
-			);
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.customizegeneratetokenrequest;
-
-import java.time.Duration;
-import org.springframework.context.annotation.Bean;
-import org.springframework.security.web.server.authentication.ott.DefaultServerGenerateOneTimeTokenRequestResolver;
-import org.springframework.security.web.server.authentication.ott.ServerGenerateOneTimeTokenRequestResolver;
-
-public class SecurityConfig {
-
-	// tag::config[]
-	@Bean
-  ServerGenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
-		DefaultServerGenerateOneTimeTokenRequestResolver resolver = new DefaultServerGenerateOneTimeTokenRequestResolver();
-		resolver.setExpiresIn(Duration.ofMinutes(10));
-		return resolver;
-	}
-	// end::config[]
-
-}
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.web.server.ServerWebExchange;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-		/**/ return Mono.empty();
-	}
-
-}
-// end::snippet[]
@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-
-// tag::snippet[]
-@Controller
-public class MyController {
-
-	@GetMapping("/my-ott-submit")
-	public String ottSubmitPage() {
-		return "my-ott-submit";
-	}
-
-}
-// end::snippet[]
@@ -1,46 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			.authorizeExchange((authorize) -> authorize
-				.pathMatchers("/my-ott-submit").permitAll()
-				.anyExchange().authenticated()
-			)
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.showDefaultSubmitPage(false)
-			);
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,84 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.sendingtokentouser;
-
-import org.springframework.mail.MailSender;
-import org.springframework.mail.SimpleMailMessage;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler;
-import org.springframework.security.web.server.authentication.ott.ServerRedirectOneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.server.ServerWebExchange;
-import org.springframework.web.util.UriComponentsBuilder;
-import reactor.core.publisher.Mono;
-
-// tag::snippet[]
-@Component // <1>
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements ServerOneTimeTokenGenerationSuccessHandler {
-
-	private final MailSender mailSender;
-
-	private final ServerOneTimeTokenGenerationSuccessHandler redirectHandler = new ServerRedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");
-
-	public MagicLinkOneTimeTokenGenerationSuccessHandler(MailSender mailSender) {
-		this.mailSender = mailSender;
-	}
-
-	@Override
-	public Mono<Void> handle(ServerWebExchange exchange, OneTimeToken oneTimeToken) {
-
-		return Mono.just(exchange.getRequest())
-			.map((request) ->
-				UriComponentsBuilder.fromUri(request.getURI())
-					.replacePath(request.getPath().contextPath().value())
-					.replaceQuery(null)
-					.fragment(null)
-					.path("/login/ott")
-					.queryParam("token", oneTimeToken.getTokenValue())
-					.toUriString() // <2>
-			)
-			.flatMap((uri) -> {
-
-				String email = getUserEmail(oneTimeToken.getUsername()); // <3>
-				SimpleMailMessage message = new SimpleMailMessage();
-				message.setTo(email);
-				message.setSubject("Your Spring Security One Time Token");
-				message.setText("Use the following link to sign in into the application: " + uri);
-				this.mailSender.send(message); // <4>
-				return Mono.empty();
-			})
-			.then(this.redirectHandler.handle(exchange, oneTimeToken)); // <5>
-	}
-
-	private String getUserEmail(String username) {
-		/**/ return username;
-	}
-
-}
-
-@Controller
-class PageController {
-
-	@GetMapping("/ott/sent")
-	String ottSent() {
-		return "my-template";
-	}
-
-}
-// end::snippet[]
@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.reactive.authentication.sendingtokentouser;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity;
-import org.springframework.security.config.web.server.ServerHttpSecurity;
-import org.springframework.security.web.server.SecurityWebFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityWebFilterChain filterChain(ServerHttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin(Customizer.withDefaults());
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.changinggenerateurl;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) {
-		// ...
-	}
-
-}
-// end::snippet[]
@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.changinggenerateurl;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.tokenGeneratingUrl("/ott/my-generate-url")
-			);
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.changingsubmitpageurl;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) {
-		// ...
-	}
-
-}
-// end::snippet[]
@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.changingsubmitpageurl;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.defaultSubmitPageUrl("/ott/submit")
-			);
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegenerateconsumetoken;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) {
-		// ...
-	}
-
-}
-// end::snippet[]
@@ -1,37 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegenerateconsumetoken;
-
-import org.jspecify.annotations.Nullable;
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken;
-import org.springframework.security.authentication.ott.OneTimeTokenService;
-
-class MyCustomOneTimeTokenService implements OneTimeTokenService {
-
-	@Override
-	public OneTimeToken generate(GenerateOneTimeTokenRequest request) {
-		return null;
-	}
-
-	@Override
-	public @Nullable OneTimeToken consume(OneTimeTokenAuthenticationToken authenticationToken) {
-		return null;
-	}
-
-}
@@ -1,47 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegenerateconsumetoken;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.authentication.ott.OneTimeTokenService;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class OneTimeTokenServiceBeanSecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-				// ...
-				.formLogin(Customizer.withDefaults())
-				.oneTimeTokenLogin(Customizer.withDefaults());
-		return http.build();
-	}
-
-	@Bean
-	public OneTimeTokenService oneTimeTokenService() {
-		return new MyCustomOneTimeTokenService();
-	}
-
-}
-// end::config[]
@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegenerateconsumetoken;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class OneTimeTokenServiceDSLSecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.tokenService(new MyCustomOneTimeTokenService())
-			);
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,39 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.customizegeneratetokenrequest;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest;
-import org.springframework.security.web.authentication.ott.DefaultGenerateOneTimeTokenRequestResolver;
-import org.springframework.security.web.authentication.ott.GenerateOneTimeTokenRequestResolver;
-
-import java.time.Duration;
-
-public class SecurityConfig {
-
-	// tag::config[]
-	@Bean
-	GenerateOneTimeTokenRequestResolver generateOneTimeTokenRequestResolver() {
-		DefaultGenerateOneTimeTokenRequestResolver delegate = new DefaultGenerateOneTimeTokenRequestResolver();
-		return (request) -> {
-			GenerateOneTimeTokenRequest generate = delegate.resolve(request);
-			return new GenerateOneTimeTokenRequest(generate.getUsername(), Duration.ofMinutes(10));
-		};
-	}
-	// end::config[]
-
-}
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.disablingdefaultsubmitpage;
-
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.stereotype.Component;
-
-// tag::snippet[]
-@Component
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) {
-		// ...
-	}
-
-}
-// end::snippet[]
@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-
-// tag::snippet[]
-@Controller
-public class MyController {
-
-	@GetMapping("/my-ott-submit")
-	public String ottSubmitPage() {
-		return "my-ott-submit";
-	}
-
-}
-// end::snippet[]
@@ -1,46 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.disablingdefaultsubmitpage;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			.authorizeHttpRequests((authorize) -> authorize
-				.requestMatchers("/my-ott-submit").permitAll()
-				.anyRequest().authenticated()
-			)
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin((ott) -> ott
-				.showDefaultSubmitPage(false)
-			);
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,80 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.sendingtokentouser;
-
-import jakarta.servlet.ServletException;
-import jakarta.servlet.http.HttpServletRequest;
-import jakarta.servlet.http.HttpServletResponse;
-import org.springframework.mail.MailSender;
-import org.springframework.mail.SimpleMailMessage;
-import org.springframework.security.authentication.ott.OneTimeToken;
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler;
-import org.springframework.security.web.authentication.ott.RedirectOneTimeTokenGenerationSuccessHandler;
-import org.springframework.security.web.util.UrlUtils;
-import org.springframework.stereotype.Component;
-import org.springframework.stereotype.Controller;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.util.UriComponentsBuilder;
-
-import java.io.IOException;
-
-// tag::snippet[]
-@Component // <1>
-public class MagicLinkOneTimeTokenGenerationSuccessHandler implements OneTimeTokenGenerationSuccessHandler {
-
-	private final MailSender mailSender;
-
-	private final OneTimeTokenGenerationSuccessHandler redirectHandler = new RedirectOneTimeTokenGenerationSuccessHandler("/ott/sent");
-
-	public MagicLinkOneTimeTokenGenerationSuccessHandler(MailSender mailSender) {
-		this.mailSender = mailSender;
-	}
-
-	@Override
-	public void handle(HttpServletRequest request, HttpServletResponse response, OneTimeToken oneTimeToken) throws IOException, ServletException {
-		UriComponentsBuilder builder = UriComponentsBuilder.fromUriString(UrlUtils.buildFullRequestUrl(request))
-				.replacePath(request.getContextPath())
-				.replaceQuery(null)
-				.fragment(null)
-				.path("/login/ott")
-				.queryParam("token", oneTimeToken.getTokenValue()); // <2>
-		String magicLink = builder.toUriString();
-		String email = getUserEmail(oneTimeToken.getUsername()); // <3>
-		SimpleMailMessage message = new SimpleMailMessage();
-		message.setTo(email);
-		message.setSubject("Your Spring Security One Time Token");
-		message.setText("Use the following link to sign in into the application: " + magicLink);
-		this.mailSender.send(message); // <4>
-		this.redirectHandler.handle(request, response, oneTimeToken); // <5>
-	}
-
-	private String getUserEmail(String username) {
-		/**/ return username;
-	}
-
-}
-
-@Controller
-class PageController {
-
-	@GetMapping("/ott/sent")
-	String ottSent() {
-		return "my-template";
-	}
-
-}
-// end::snippet[]
@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.docs.servlet.authentication.sendingtokentouser;
-
-import org.springframework.context.annotation.Bean;
-import org.springframework.context.annotation.Configuration;
-import org.springframework.security.config.Customizer;
-import org.springframework.security.config.annotation.web.builders.HttpSecurity;
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
-import org.springframework.security.web.SecurityFilterChain;
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-public class SecurityConfig {
-
-	@Bean
-	public SecurityFilterChain filterChain(HttpSecurity http) {
-		http
-			// ...
-			.formLogin(Customizer.withDefaults())
-			.oneTimeTokenLogin(Customizer.withDefaults());
-		return http.build();
-	}
-
-}
-// end::config[]
@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.changinggenerateurl
-
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.web.server.ServerWebExchange
-import reactor.core.publisher.Mono
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : ServerOneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-        /**/ return Mono.empty()
-    }
-
-}
-// end::snippet[]
@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.changinggenerateurl
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class SecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            // ...
-            formLogin { }
-            oneTimeTokenLogin {
-                tokenGeneratingUrl = "/ott/my-generate-url"
-            }
-        }
-    }
-
-}
-// end::config[]
@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.changingsubmitpageurl
-
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.web.server.ServerWebExchange
-import reactor.core.publisher.Mono
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : ServerOneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-        /**/ return Mono.empty()
-    }
-
-}
-// end::snippet[]
@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.changingsubmitpageurl
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class SecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            // ...
-            formLogin { }
-            oneTimeTokenLogin {
-                defaultSubmitPageUrl = "/ott/submit"
-            }
-        }
-    }
-
-}
-// end::config[]
@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken
-
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.web.server.ServerWebExchange
-import reactor.core.publisher.Mono
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : ServerOneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-        /**/ return Mono.empty()
-    }
-
-}
-// end::snippet[]
@@ -1,36 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken
-
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken
-import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService
-import reactor.core.publisher.Mono
-
-class MyCustomReactiveOneTimeTokenService: ReactiveOneTimeTokenService {
-
-    override fun generate(request: GenerateOneTimeTokenRequest): Mono<OneTimeToken> {
-        TODO("Not yet implemented")
-    }
-
-    override fun consume(authenticationToken: OneTimeTokenAuthenticationToken): Mono<OneTimeToken> {
-        TODO("Not yet implemented")
-    }
-
-
-}
@@ -1,46 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.authentication.ott.reactive.ReactiveOneTimeTokenService
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class OneTimeTokenServiceBeanSecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            //..
-            formLogin { }
-            oneTimeTokenLogin { }
-        }
-    }
-
-    @Bean
-    open fun oneTimeTokenService(): ReactiveOneTimeTokenService {
-        return MyCustomReactiveOneTimeTokenService()
-    }
-
-}
-// end::config[]
@@ -1,41 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegenerateconsumetoken
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class OneTimeTokenServiceDSLSecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            //..
-            formLogin { }
-            oneTimeTokenLogin {
-                tokenService = MyCustomReactiveOneTimeTokenService()
-            }
-        }
-    }
-
-}
-// end::config[]
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.customizegeneratetokenrequest
-
-import org.springframework.context.annotation.Bean
-import org.springframework.security.web.server.authentication.ott.DefaultServerGenerateOneTimeTokenRequestResolver
-import org.springframework.security.web.server.authentication.ott.ServerGenerateOneTimeTokenRequestResolver
-import java.time.Duration
-
-open class SecurityConfig {
-
-    // tag::config[]
-    @Bean
-    fun generateOneTimeTokenRequestResolver() : ServerGenerateOneTimeTokenRequestResolver {
-        return DefaultServerGenerateOneTimeTokenRequestResolver().apply {
-            this.setExpiresIn(Duration.ofMinutes(10))
-        }
-    }
-    // end::config[]
-
-}
@@ -1,35 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.disablingdefaultsubmitpage
-
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.web.server.ServerWebExchange
-import reactor.core.publisher.Mono
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : ServerOneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-        /**/ return Mono.empty()
-    }
-
-}
-
-// end::snippet[]
@@ -1,32 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.disablingdefaultsubmitpage
-
-import org.springframework.stereotype.Controller
-import org.springframework.web.bind.annotation.GetMapping
-
-// tag::snippet[]
-@Controller
-class MyController {
-
-    @GetMapping("/my-ott-submit")
-    fun ottSubmitPage(): String {
-        return "my-ott-submit"
-    }
-
-}
-// end::snippet[]
@@ -1,45 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.disablingdefaultsubmitpage
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-import org.springframework.security.web.server.util.matcher.ServerWebExchangeMatchers.pathMatchers
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class SecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            authorizeExchange {
-                authorize(pathMatchers("/my-ott-submit"), permitAll)
-                authorize(anyExchange, authenticated)
-            }
-            formLogin { }
-            oneTimeTokenLogin {
-                showDefaultSubmitPage = false
-            }
-        }
-    }
-
-}
-// end::config[]
@@ -1,78 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.sendingtokentouser
-
-import org.springframework.mail.MailSender
-import org.springframework.mail.SimpleMailMessage
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.server.authentication.ott.ServerOneTimeTokenGenerationSuccessHandler
-import org.springframework.security.web.server.authentication.ott.ServerRedirectOneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-import org.springframework.stereotype.Controller
-import org.springframework.web.bind.annotation.GetMapping
-import org.springframework.web.server.ServerWebExchange
-import org.springframework.web.util.UriComponentsBuilder
-import reactor.core.publisher.Mono
-import java.util.function.Function
-
-
-// tag::snippet[]
-@Component // <1>
-class MagicLinkOneTimeTokenGenerationSuccessHandler(val mailSender: MailSender) : ServerOneTimeTokenGenerationSuccessHandler {
-
-    private val redirectHandler: ServerOneTimeTokenGenerationSuccessHandler = ServerRedirectOneTimeTokenGenerationSuccessHandler("/ott/sent")
-
-    override fun handle(exchange: ServerWebExchange, oneTimeToken: OneTimeToken): Mono<Void> {
-
-        return Mono.just(exchange.request)
-            .map(Function { request ->
-                UriComponentsBuilder.fromUri(request.uri)
-                    .replacePath(request.path.contextPath().value())
-                    .replaceQuery(null)
-                    .fragment(null)
-                    .path("/login/ott")
-                    .queryParam("token", oneTimeToken.getTokenValue())
-                    .toUriString() // <2>
-            })
-            .flatMap(Function { uri ->
-                val email = getUserEmail(oneTimeToken.getUsername()) // <3>
-                val message = SimpleMailMessage()
-                message.setTo(email)
-                message.subject = "Your Spring Security One Time Token"
-                message.text = "Use the following link to sign in into the application: $uri"
-                this.mailSender.send(message) // <4>
-                Mono.empty()
-            })
-            .then(this.redirectHandler.handle(exchange, oneTimeToken)) // <5>
-    }
-
-    private fun getUserEmail(username: String): String {
-        /**/ return username
-    }
-
-}
-
-@Controller
-class PageController {
-
-    @GetMapping("/ott/sent")
-    fun ottSent(): String {
-        return "my-template"
-    }
-
-}
-// end::snippet[]
@@ -1,40 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.reactive.authentication.sendingtokentouser
-
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.reactive.EnableWebFluxSecurity
-import org.springframework.security.config.web.server.ServerHttpSecurity
-import org.springframework.security.config.web.server.invoke
-import org.springframework.security.web.server.SecurityWebFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebFluxSecurity
-open class SecurityConfig {
-
-    open fun springWebFilterChain(http: ServerHttpSecurity): SecurityWebFilterChain {
-        return http {
-            authorizeExchange {
-                authorize(anyExchange, authenticated)
-            }
-            oneTimeTokenLogin { }
-        }
-    }
-
-}
-// end::config[]
@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.changinggenerateurl
-
-import jakarta.servlet.http.HttpServletRequest
-import jakarta.servlet.http.HttpServletResponse
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        // ...
-    }
-
-}
-// end::snippet[]
@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.changinggenerateurl
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class SecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            //...
-            formLogin { }
-            oneTimeTokenLogin {
-                tokenGeneratingUrl = "/ott/my-generate-url"
-            }
-        }
-        return http.build()
-    }
-}
-// end::config[]
@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.changingsubmitpageurl
-
-import jakarta.servlet.http.HttpServletRequest
-import jakarta.servlet.http.HttpServletResponse
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        // ...
-    }
-
-}
-// end::snippet[]
@@ -1,43 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.changingsubmitpageurl
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class SecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            //...
-            formLogin { }
-            oneTimeTokenLogin {
-                defaultSubmitPageUrl = "/ott/submit"
-            }
-        }
-        return http.build()
-    }
-}
-// end::config[]
@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *      https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegenerateconsumetoken
-
-import jakarta.servlet.http.HttpServletRequest
-import jakarta.servlet.http.HttpServletResponse
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.web.authentication.ott.OneTimeTokenGenerationSuccessHandler
-import org.springframework.stereotype.Component
-
-// tag::snippet[]
-@Component
-class MagicLinkOneTimeTokenGenerationSuccessHandler : OneTimeTokenGenerationSuccessHandler {
-
-    override fun handle(request: HttpServletRequest, response: HttpServletResponse, oneTimeToken: OneTimeToken) {
-        // ...
-    }
-
-}
-// end::snippet[]
@@ -1,34 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegenerateconsumetoken
-
-import org.springframework.security.authentication.ott.GenerateOneTimeTokenRequest
-import org.springframework.security.authentication.ott.OneTimeToken
-import org.springframework.security.authentication.ott.OneTimeTokenAuthenticationToken
-import org.springframework.security.authentication.ott.OneTimeTokenService
-
-class MyCustomOneTimeTokenService: OneTimeTokenService {
-
-    override fun generate(request: GenerateOneTimeTokenRequest): OneTimeToken {
-        TODO("Not yet implemented")
-    }
-
-    override fun consume(authenticationToken: OneTimeTokenAuthenticationToken): OneTimeToken? {
-        TODO("Not yet implemented")
-    }
-
-}
@@ -1,48 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegenerateconsumetoken
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.authentication.ott.OneTimeTokenService
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class OneTimeTokenServiceBeanSecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            //...
-            formLogin { }
-            oneTimeTokenLogin { }
-        }
-        return http.build()
-    }
-
-    @Bean
-    open fun oneTimeTokenService(): OneTimeTokenService {
-        return MyCustomOneTimeTokenService()
-    }
-
-}
-// end::config[]
@@ -1,44 +0,0 @@
-/*
- * Copyright 2004-present the original author or authors.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- *	  https://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- */
-
-package org.springframework.security.kt.docs.servlet.authentication.customizegenerateconsumetoken
-
-import org.springframework.context.annotation.Bean
-import org.springframework.context.annotation.Configuration
-import org.springframework.security.config.annotation.web.builders.HttpSecurity
-import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
-import org.springframework.security.config.annotation.web.invoke
-import org.springframework.security.web.SecurityFilterChain
-
-// tag::config[]
-@Configuration
-@EnableWebSecurity
-open class OneTimeTokenServiceDSLSecurityConfig {
-
-    @Bean
-    open fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http {
-            //...
-            formLogin { }
-            oneTimeTokenLogin {
-                tokenService = MyCustomOneTimeTokenService()
-            }
-        }
-        return http.build()
-    }
-
-}
-// end::config[]
--- a/Show More
+++ b/Show More