Upgrading org.springframework.security:spring-security-core 6 to 7
Breaking6.5.11 → 7.1.2Breaking50Security9Deprecated2New95Changed410Fixed96Other304
BreakingUpgrade verdict
48 breaking changes and 9 security fixes.
In plain terms
- Remove unnecessary ObjectProvider<RoleHierarchy> roleHierarchy parameter.
- The device code grant may no longer be enabled unless you turn it on explicitly.
- Proof Key for Code Exchange is now required by default for OAuth2 clients.
- The authorization server now expects PKCE by default.
Must act Top 5 of 59 that need code or config changes
Installs 10 packages in all (was 9).
What you must change
Breaking48
Remove unnecessary ObjectProvider<RoleHierarchy> roleHierarchy parameter.
ObjectProviderRoleHierarchyConsiders disabling the device_code grant by default.
device_codeEnables PKCE by default.
PKCEEnables PKCE by default in the authorization server.
PKCEFavors relative redirects by default.
Removes the cache from (Reactive)OidcIdTokenDecoderFactory.
OidcIdTokenDecoderFactoryReactiveOidcIdTokenDecoderFactoryRemoves OidcUserService.setAccessibleScopes().
OidcUserService.setAccessibleScopes()Removes setOidcUserMapper() in OidcUserService and OidcReactiveOAuth2UserService.
OidcUserService.setOidcUserMapper()OidcReactiveOAuth2UserService.setOidcUserMapper()Removes unnecessary throws Exception from spring-security-config.
Renames AllFactorsAuthorizationManager to AllRequiredFactorsAuthorizationManager.
AllFactorsAuthorizationManagerAllRequiredFactorsAuthorizationManagerRemoves PortResolver.
PortResolverSupports Expression Templates by default, changing how expressions are evaluated.
Removes OpenSAML 4 support.
OpenSAMLDefaults to XorCsrfChannelInterceptor in XML configuration.
XorCsrfChannelInterceptorRemoves .and() and non lambda methods from the DSL.
Removes authorizeRequests.
authorizeRequestsRemoves the AbstractConfiguredSecurityBuilder apply method.
AbstractConfiguredSecurityBuilderRemoves AbstractSecurityWebSocketMessageBrokerConfigurer.
AbstractSecurityWebSocketMessageBrokerConfigurerRemoves ApacheDS support.
ApacheDSRemoves APPLICATION_JSON_UTF8 usage.
APPLICATION_JSON_UTF8Removes AssertingPartyDetails from APIs in favor of AssertingPartyMetadata.
AssertingPartyDetailsAssertingPartyMetadataRemoves deprecated classes moved to other packages.
Removes deprecated elements from DaoAuthenticationProvider.
DaoAuthenticationProviderRemoves deprecated elements of RoleHierarchyImpl.
RoleHierarchyImplRemoves deprecated elements using AuthorizationDecision.
AuthorizationDecisionRemoves deprecated implementations of OAuth2AccessTokenResponseClient.
OAuth2AccessTokenResponseClientRemoves deprecated methods from CookieServerCsrfTokenRepository.
CookieServerCsrfTokenRepositoryRemoves deprecations from CookieCsrfTokenRepository.
CookieCsrfTokenRepositoryRemoves EnableWebMvcSecurity.
EnableWebMvcSecurityRemoves HandlerMappingIntrospector usage.
HandlerMappingIntrospectorRemoves LazyCsrfTokenRepository.
LazyCsrfTokenRepositoryRemoves the Nimbus and Reactive Nimbus opaque token introspectors.
NimbusOpaqueTokenIntrospectorNimbusReactiveOpaqueTokenIntrospectorRemoves the no-version Open SAML implementations.
Removes PrePostTemplateDefaults.
PrePostTemplateDefaultsRemoves deprecated RelyingPartyRegistration APIs.
RelyingPartyRegistrationRemoves RequestVariablesExtractor.
RequestVariablesExtractorRemoves the Resource Owner Password Credentials grant.
Removes shouldFilterAllDispatcherTypes.
shouldFilterAllDispatcherTypesRemoves usage of PathMatcher in messaging.
PathMatcherRemoves the 32-byte minimum keyLength restriction in Base64StringKeyGenerator.
Base64StringKeyGeneratorRemoves GET request support from Saml2AuthenticationTokenConverter.
Saml2AuthenticationTokenConverterAligns setRetrieveUserInfo() between OidcUserService and OidcReactiveOAuth2UserService.
OidcUserService.setRetrieveUserInfo()OidcReactiveOAuth2UserService.setRetrieveUserInfo()Moves the Access API to a separate module.
Addresses BouncyCastle's deprecated AESFastEngine usage.
AESFastEngineStops caching WebSocket requests in RequestCache.
RequestCacheImproves the JdbcUserDetailsManager.userExists method.
JdbcUserDetailsManager.userExists()Uses LdapName instead of DistinguishedName.
LdapNameDistinguishedNameReplaces deprecated NimbusReactiveOpaqueTokenIntrospector with SpringReactiveOpaqueTokenIntrospector.
NimbusReactiveOpaqueTokenIntrospectorSpringReactiveOpaqueTokenIntrospectorSecurity9
Fixes cve-2026-59277.
Fixes cve-2026-41707.
Fixes cve-2026-47841.
Fixes cve-2026-47842.
Fixes cve-2026-47877.
Fixes cve-2026-59270.
Fixes cve-2026-59276.
Spring Security Vulnerable to User Attribute Enumeration when Using DaoAuthenticationProvider
Low · CVSS 3.7Spring Security Core has a TOCTOU race condition when One-Time Token login with JdbcOneTimeTokenService is configured
Moderate · CVSS 4.8Deprecations to plan for
Deprecated2
Deprecates CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUE.
CacheControlServerHttpHeadersWriter.CACHE_CONTRTOL_VALUEDeprecates the X5T JOSE header name.
X5TAPI changes
Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.
- removed:
class SecurityConfig implements ConfigAttribute - removed:
ctor SecurityConfig(String) - removed:
interface AccessDecisionManager - removed:
interface AccessDecisionVoter - removed:
interface AfterInvocationProvider - removed:
interface ConfigAttribute extends Serializable - removed:
interface SecurityMetadataSource extends AopInfrastructureBean - removed:
method AccessDecisionManager.decide(Authentication, Object, Collection): void - removed:
method AccessDecisionManager.supports(Class): boolean - removed:
method AccessDecisionManager.supports(ConfigAttribute): boolean - removed:
method AccessDecisionVoter.supports(Class): boolean - removed:
method AccessDecisionVoter.supports(ConfigAttribute): boolean - removed:
method AccessDecisionVoter.vote(Authentication, Object, Collection): int - removed:
method AfterInvocationProvider.decide(Authentication, Object, Collection, Object): Object - removed:
method AfterInvocationProvider.supports(Class): boolean - removed:
method AfterInvocationProvider.supports(ConfigAttribute): boolean - removed:
method ConfigAttribute.getAttribute(): String - removed:
method SecurityConfig.equals(Object): boolean - removed:
method SecurityConfig.getAttribute(): String - removed:
method SecurityConfig.hashCode(): int - removed:
method SecurityConfig.toString(): String - removed:
method SecurityMetadataSource.getAllConfigAttributes(): Collection - removed:
method SecurityMetadataSource.getAttributes(Object): Collection - removed:
method SecurityMetadataSource.supports(Class): boolean - removed:
static field AccessDecisionVoter.ACCESS_ABSTAIN: int - removed:
static field AccessDecisionVoter.ACCESS_DENIED: int - removed:
static field AccessDecisionVoter.ACCESS_GRANTED: int - removed:
static method SecurityConfig.createList(String[]): List - removed:
static method SecurityConfig.createListFromCommaDelimitedString(String): List
- removed:
class Jsr250MethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource - removed:
class Jsr250SecurityConfig extends SecurityConfig - removed:
class Jsr250Voter implements AccessDecisionVoter - removed:
class SecuredAnnotationSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource - removed:
ctor Jsr250MethodSecurityMetadataSource() - removed:
ctor Jsr250SecurityConfig(String) - removed:
ctor Jsr250Voter() - removed:
ctor SecuredAnnotationSecurityMetadataSource() - removed:
ctor SecuredAnnotationSecurityMetadataSource(AnnotationMetadataExtractor) - removed:
interface AnnotationMetadataExtractor - removed:
method AnnotationMetadataExtractor.extractAttributes(Annotation): Collection - removed:
method Jsr250MethodSecurityMetadataSource.findAttributes(Class): Collection - removed:
method Jsr250MethodSecurityMetadataSource.findAttributes(Method, Class): Collection - removed:
method Jsr250MethodSecurityMetadataSource.getAllConfigAttributes(): Collection - removed:
method Jsr250MethodSecurityMetadataSource.setDefaultRolePrefix(String): void - removed:
method Jsr250Voter.supports(Class): boolean - removed:
method Jsr250Voter.supports(ConfigAttribute): boolean - removed:
method Jsr250Voter.vote(Authentication, Object, Collection): int - removed:
method SecuredAnnotationSecurityMetadataSource.findAttributes(Class): Collection - removed:
method SecuredAnnotationSecurityMetadataSource.findAttributes(Method, Class): Collection - removed:
method SecuredAnnotationSecurityMetadataSource.getAllConfigAttributes(): Collection - removed:
static field Jsr250SecurityConfig.DENY_ALL_ATTRIBUTE: Jsr250SecurityConfig - removed:
static field Jsr250SecurityConfig.PERMIT_ALL_ATTRIBUTE: Jsr250SecurityConfig
- removed:
abstract class AbstractAuthorizationEvent extends ApplicationEvent - removed:
class AuthenticationCredentialsNotFoundEvent extends AbstractAuthorizationEvent - removed:
class AuthorizationFailureEvent extends AbstractAuthorizationEvent - removed:
class AuthorizedEvent extends AbstractAuthorizationEvent - removed:
class LoggerListener implements ApplicationListener - removed:
class PublicInvocationEvent extends AbstractAuthorizationEvent - removed:
ctor AbstractAuthorizationEvent(Object) - removed:
ctor AuthenticationCredentialsNotFoundEvent(Object, Collection, AuthenticationCredentialsNotFoundException) - removed:
ctor AuthorizationFailureEvent(Object, Collection, Authentication, AccessDeniedException) - removed:
ctor AuthorizedEvent(Object, Collection, Authentication) - removed:
ctor LoggerListener() - removed:
ctor PublicInvocationEvent(Object) - removed:
method AuthenticationCredentialsNotFoundEvent.getConfigAttributes(): Collection - removed:
method AuthenticationCredentialsNotFoundEvent.getCredentialsNotFoundException(): AuthenticationCredentialsNotFoundException - removed:
method AuthorizationFailureEvent.getAccessDeniedException(): AccessDeniedException - removed:
method AuthorizationFailureEvent.getAuthentication(): Authentication - removed:
method AuthorizationFailureEvent.getConfigAttributes(): Collection - removed:
method AuthorizedEvent.getAuthentication(): Authentication - removed:
method AuthorizedEvent.getConfigAttributes(): Collection - removed:
method LoggerListener.onApplicationEvent(AbstractAuthorizationEvent): void
- added:
ctor SecurityExpressionRoot(Supplier, Object) - added:
method AbstractSecurityExpressionHandler.getAuthorizationManagerFactory(): AuthorizationManagerFactory - added:
method AbstractSecurityExpressionHandler.getDefaultAuthorizationManagerFactory(): DefaultAuthorizationManagerFactory - added:
method AbstractSecurityExpressionHandler.setAuthorizationManagerFactory(AuthorizationManagerFactory): void - added:
method SecurityExpressionRoot.hasAllAuthorities(String[]): boolean - added:
method SecurityExpressionRoot.hasAllRoles(String[]): boolean - added:
method SecurityExpressionRoot.setAuthorizationManagerFactory(AuthorizationManagerFactory): void
- removed:
class ExpressionBasedAnnotationAttributeFactory implements PrePostInvocationAttributeFactory - removed:
class ExpressionBasedPostInvocationAdvice implements PostInvocationAuthorizationAdvice - removed:
class ExpressionBasedPreInvocationAdvice implements PreInvocationAuthorizationAdvice - removed:
ctor ExpressionBasedAnnotationAttributeFactory(MethodSecurityExpressionHandler) - removed:
ctor ExpressionBasedPostInvocationAdvice(MethodSecurityExpressionHandler) - removed:
ctor ExpressionBasedPreInvocationAdvice() - removed:
field ExpressionBasedPostInvocationAdvice.logger: Log - removed:
method ExpressionBasedAnnotationAttributeFactory.createPostInvocationAttribute(String, String): PostInvocationAttribute - removed:
method ExpressionBasedAnnotationAttributeFactory.createPreInvocationAttribute(String, String, String): PreInvocationAttribute - removed:
method ExpressionBasedPostInvocationAdvice.after(Authentication, MethodInvocation, PostInvocationAttribute, Object): Object - removed:
method ExpressionBasedPreInvocationAdvice.before(Authentication, MethodInvocation, PreInvocationAttribute): boolean - removed:
method ExpressionBasedPreInvocationAdvice.setExpressionHandler(MethodSecurityExpressionHandler): void
- removed:
ctor RoleHierarchyImpl() - removed:
method RoleHierarchyImpl.setHierarchy(String): void - changed:
class RoleHierarchyImpl implements RoleHierarchy → final class RoleHierarchyImpl implements RoleHierarchy
- removed:
abstract class AbstractSecurityInterceptor implements InitializingBean, ApplicationEventPublisherAware, MessageSourceAware - removed:
class AfterInvocationProviderManager implements AfterInvocationManager, InitializingBean - removed:
class InterceptorStatusToken - removed:
class MethodInvocationPrivilegeEvaluator implements InitializingBean - removed:
class RunAsImplAuthenticationProvider implements InitializingBean, AuthenticationProvider, MessageSourceAware - removed:
class RunAsManagerImpl implements RunAsManager, InitializingBean - removed:
class RunAsUserToken extends AbstractAuthenticationToken - removed:
ctor AbstractSecurityInterceptor() - removed:
ctor AfterInvocationProviderManager() - removed:
ctor InterceptorStatusToken(SecurityContext, boolean, Collection, Object) - removed:
ctor MethodInvocationPrivilegeEvaluator() - removed:
ctor RunAsImplAuthenticationProvider() - removed:
ctor RunAsManagerImpl() - removed:
ctor RunAsUserToken(String, Object, Object, Collection, Class) - removed:
field AbstractSecurityInterceptor.logger: Log - removed:
field AbstractSecurityInterceptor.messages: MessageSourceAccessor - removed:
field RunAsImplAuthenticationProvider.messages: MessageSourceAccessor - removed:
interface AfterInvocationManager - removed:
interface RunAsManager - removed:
method AbstractSecurityInterceptor.afterInvocation(InterceptorStatusToken, Object): Object - removed:
method AbstractSecurityInterceptor.afterPropertiesSet(): void - removed:
method AbstractSecurityInterceptor.beforeInvocation(Object): InterceptorStatusToken - removed:
method AbstractSecurityInterceptor.finallyInvocation(InterceptorStatusToken): void - removed:
method AbstractSecurityInterceptor.getAccessDecisionManager(): AccessDecisionManager - removed:
method AbstractSecurityInterceptor.getAfterInvocationManager(): AfterInvocationManager - removed:
method AbstractSecurityInterceptor.getAuthenticationManager(): AuthenticationManager - removed:
method AbstractSecurityInterceptor.getRunAsManager(): RunAsManager - removed:
method AbstractSecurityInterceptor.getSecureObjectClass(): Class - removed:
method AbstractSecurityInterceptor.isAlwaysReauthenticate(): boolean - removed:
method AbstractSecurityInterceptor.isRejectPublicInvocations(): boolean - removed:
method AbstractSecurityInterceptor.isValidateConfigAttributes(): boolean - removed:
method AbstractSecurityInterceptor.obtainSecurityMetadataSource(): SecurityMetadataSource - removed:
method AbstractSecurityInterceptor.setAccessDecisionManager(AccessDecisionManager): void - removed:
method AbstractSecurityInterceptor.setAfterInvocationManager(AfterInvocationManager): void - removed:
method AbstractSecurityInterceptor.setAlwaysReauthenticate(boolean): void - removed:
method AbstractSecurityInterceptor.setApplicationEventPublisher(ApplicationEventPublisher): void - removed:
method AbstractSecurityInterceptor.setAuthenticationManager(AuthenticationManager): void - removed:
method AbstractSecurityInterceptor.setMessageSource(MessageSource): void - removed:
method AbstractSecurityInterceptor.setPublishAuthorizationSuccess(boolean): void - removed:
method AbstractSecurityInterceptor.setRejectPublicInvocations(boolean): void - removed:
method AbstractSecurityInterceptor.setRunAsManager(RunAsManager): void - removed:
method AbstractSecurityInterceptor.setSecurityContextHolderStrategy(SecurityContextHolderStrategy): void - removed:
method AbstractSecurityInterceptor.setValidateConfigAttributes(boolean): void - removed:
method AfterInvocationManager.decide(Authentication, Object, Collection, Object): Object - removed:
method AfterInvocationManager.supports(Class): boolean - removed:
method AfterInvocationManager.supports(ConfigAttribute): boolean - removed:
method AfterInvocationProviderManager.afterPropertiesSet(): void - removed:
method AfterInvocationProviderManager.decide(Authentication, Object, Collection, Object): Object - removed:
method AfterInvocationProviderManager.getProviders(): List - removed:
method AfterInvocationProviderManager.setProviders(List): void - removed:
method AfterInvocationProviderManager.supports(Class): boolean - removed:
method AfterInvocationProviderManager.supports(ConfigAttribute): boolean - removed:
method InterceptorStatusToken.getAttributes(): Collection - removed:
method InterceptorStatusToken.getSecureObject(): Object - removed:
method InterceptorStatusToken.getSecurityContext(): SecurityContext - removed:
method InterceptorStatusToken.isContextHolderRefreshRequired(): boolean - removed:
method MethodInvocationPrivilegeEvaluator.afterPropertiesSet(): void - removed:
method MethodInvocationPrivilegeEvaluator.isAllowed(MethodInvocation, Authentication): boolean - removed:
method MethodInvocationPrivilegeEvaluator.setSecurityInterceptor(AbstractSecurityInterceptor): void - removed:
method RunAsImplAuthenticationProvider.afterPropertiesSet(): void - removed:
method RunAsImplAuthenticationProvider.authenticate(Authentication): Authentication - removed:
method RunAsImplAuthenticationProvider.getKey(): String - removed:
method RunAsImplAuthenticationProvider.setKey(String): void - removed:
method RunAsImplAuthenticationProvider.setMessageSource(MessageSource): void - removed:
method RunAsImplAuthenticationProvider.supports(Class): boolean - removed:
method RunAsManager.buildRunAs(Authentication, Object, Collection): Authentication - removed:
method RunAsManager.supports(Class): boolean - removed:
method RunAsManager.supports(ConfigAttribute): boolean - removed:
method RunAsManagerImpl.afterPropertiesSet(): void - removed:
method RunAsManagerImpl.buildRunAs(Authentication, Object, Collection): Authentication - removed:
method RunAsManagerImpl.getKey(): String - removed:
method RunAsManagerImpl.getRolePrefix(): String - removed:
method RunAsManagerImpl.setKey(String): void - removed:
method RunAsManagerImpl.setRolePrefix(String): void - removed:
method RunAsManagerImpl.supports(Class): boolean - removed:
method RunAsManagerImpl.supports(ConfigAttribute): boolean - removed:
method RunAsUserToken.getCredentials(): Object - removed:
method RunAsUserToken.getKeyHash(): int - removed:
method RunAsUserToken.getOriginalAuthentication(): Class - removed:
method RunAsUserToken.getPrincipal(): Object - removed:
method RunAsUserToken.toString(): String - removed:
static field AfterInvocationProviderManager.logger: Log - removed:
static field MethodInvocationPrivilegeEvaluator.logger: Log
- removed:
class MethodSecurityInterceptor extends AbstractSecurityInterceptor implements MethodInterceptor - removed:
class MethodSecurityMetadataSourceAdvisor extends AbstractPointcutAdvisor implements BeanFactoryAware - removed:
ctor MethodSecurityInterceptor() - removed:
ctor MethodSecurityMetadataSourceAdvisor(String, MethodSecurityMetadataSource, String) - removed:
method MethodSecurityInterceptor.getSecureObjectClass(): Class - removed:
method MethodSecurityInterceptor.getSecurityMetadataSource(): MethodSecurityMetadataSource - removed:
method MethodSecurityInterceptor.invoke(MethodInvocation): Object - removed:
method MethodSecurityInterceptor.obtainSecurityMetadataSource(): SecurityMetadataSource - removed:
method MethodSecurityInterceptor.setSecurityMetadataSource(MethodSecurityMetadataSource): void - removed:
method MethodSecurityMetadataSourceAdvisor.getAdvice(): Advice - removed:
method MethodSecurityMetadataSourceAdvisor.getPointcut(): Pointcut - removed:
method MethodSecurityMetadataSourceAdvisor.setBeanFactory(BeanFactory): void
- removed:
ctor AspectJMethodSecurityInterceptor() - removed:
final class AspectJMethodSecurityInterceptor extends MethodSecurityInterceptor - removed:
final class MethodInvocationAdapter implements MethodInvocation - removed:
interface AspectJCallback - removed:
method AspectJCallback.proceedWithObject(): Object - removed:
method AspectJMethodSecurityInterceptor.invoke(JoinPoint): Object - removed:
method AspectJMethodSecurityInterceptor.invoke(JoinPoint, AspectJCallback): Object - removed:
method MethodInvocationAdapter.getArguments(): Object[] - removed:
method MethodInvocationAdapter.getMethod(): Method - removed:
method MethodInvocationAdapter.getStaticPart(): AccessibleObject - removed:
method MethodInvocationAdapter.getThis(): Object - removed:
method MethodInvocationAdapter.proceed(): Object
- removed:
@interface P - removed:
abstract class AbstractFallbackMethodSecurityMetadataSource extends AbstractMethodSecurityMetadataSource - removed:
abstract class AbstractMethodSecurityMetadataSource implements MethodSecurityMetadataSource - removed:
class MapBasedMethodSecurityMetadataSource extends AbstractFallbackMethodSecurityMetadataSource implements BeanClassLoaderAware - removed:
ctor AbstractFallbackMethodSecurityMetadataSource() - removed:
ctor AbstractMethodSecurityMetadataSource() - removed:
ctor DelegatingMethodSecurityMetadataSource(List) - removed:
ctor MapBasedMethodSecurityMetadataSource() - removed:
ctor MapBasedMethodSecurityMetadataSource(Map) - removed:
field AbstractMethodSecurityMetadataSource.logger: Log - removed:
field MapBasedMethodSecurityMetadataSource.methodMap: Map - removed:
final class DelegatingMethodSecurityMetadataSource extends AbstractMethodSecurityMetadataSource - removed:
interface MethodSecurityMetadataSource extends SecurityMetadataSource - removed:
method AbstractFallbackMethodSecurityMetadataSource.findAttributes(Class): Collection - removed:
method AbstractFallbackMethodSecurityMetadataSource.findAttributes(Method, Class): Collection - removed:
method AbstractFallbackMethodSecurityMetadataSource.getAttributes(Method, Class): Collection - removed:
method AbstractMethodSecurityMetadataSource.getAttributes(Object): Collection - removed:
method AbstractMethodSecurityMetadataSource.supports(Class): boolean - removed:
method DelegatingMethodSecurityMetadataSource.getAllConfigAttributes(): Collection - removed:
method DelegatingMethodSecurityMetadataSource.getAttributes(Method, Class): Collection - removed:
method DelegatingMethodSecurityMetadataSource.getMethodSecurityMetadataSources(): List - removed:
method MapBasedMethodSecurityMetadataSource.addSecureMethod(Class, Method, List): void - removed:
method MapBasedMethodSecurityMetadataSource.addSecureMethod(Class, String, List): void - removed:
method MapBasedMethodSecurityMetadataSource.findAttributes(Class): Collection - removed:
method MapBasedMethodSecurityMetadataSource.findAttributes(Method, Class): Collection - removed:
method MapBasedMethodSecurityMetadataSource.getAllConfigAttributes(): Collection - removed:
method MapBasedMethodSecurityMetadataSource.getMethodMapSize(): int - removed:
method MapBasedMethodSecurityMetadataSource.setBeanClassLoader(ClassLoader): void - removed:
method MethodSecurityMetadataSource.getAttributes(Method, Class): Collection - removed:
method P.value(): String
- removed:
class PostInvocationAdviceProvider implements AfterInvocationProvider - removed:
class PreInvocationAuthorizationAdviceVoter implements AccessDecisionVoter - removed:
class PrePostAdviceReactiveMethodInterceptor implements MethodInterceptor - removed:
class PrePostAnnotationSecurityMetadataSource extends AbstractMethodSecurityMetadataSource - removed:
ctor PostInvocationAdviceProvider(PostInvocationAuthorizationAdvice) - removed:
ctor PreInvocationAuthorizationAdviceVoter(PreInvocationAuthorizationAdvice) - removed:
ctor PrePostAdviceReactiveMethodInterceptor(MethodSecurityMetadataSource, PreInvocationAuthorizationAdvice, PostInvocationAuthorizationAdvice) - removed:
ctor PrePostAnnotationSecurityMetadataSource(PrePostInvocationAttributeFactory) - removed:
field PostInvocationAdviceProvider.logger: Log - removed:
field PreInvocationAuthorizationAdviceVoter.logger: Log - removed:
interface PostInvocationAttribute extends ConfigAttribute - removed:
interface PostInvocationAuthorizationAdvice extends AopInfrastructureBean - removed:
interface PreInvocationAttribute extends ConfigAttribute - removed:
interface PreInvocationAuthorizationAdvice extends AopInfrastructureBean - removed:
interface PrePostInvocationAttributeFactory extends AopInfrastructureBean - removed:
method PostInvocationAdviceProvider.decide(Authentication, Object, Collection, Object): Object - removed:
method PostInvocationAdviceProvider.supports(Class): boolean - removed:
method PostInvocationAdviceProvider.supports(ConfigAttribute): boolean - removed:
method PostInvocationAuthorizationAdvice.after(Authentication, MethodInvocation, PostInvocationAttribute, Object): Object - removed:
method PreInvocationAuthorizationAdvice.before(Authentication, MethodInvocation, PreInvocationAttribute): boolean - removed:
method PreInvocationAuthorizationAdviceVoter.supports(Class): boolean - removed:
method PreInvocationAuthorizationAdviceVoter.supports(ConfigAttribute): boolean - removed:
method PreInvocationAuthorizationAdviceVoter.vote(Authentication, MethodInvocation, Collection): int - removed:
method PrePostAdviceReactiveMethodInterceptor.invoke(MethodInvocation): Object - removed:
method PrePostAnnotationSecurityMetadataSource.getAllConfigAttributes(): Collection - removed:
method PrePostAnnotationSecurityMetadataSource.getAttributes(Method, Class): Collection - removed:
method PrePostInvocationAttributeFactory.createPostInvocationAttribute(String, String): PostInvocationAttribute - removed:
method PrePostInvocationAttributeFactory.createPreInvocationAttribute(String, String, String): PreInvocationAttribute
- removed:
abstract class AbstractAccessDecisionManager implements AccessDecisionManager, InitializingBean, MessageSourceAware - removed:
abstract class AbstractAclVoter implements AccessDecisionVoter - removed:
class AffirmativeBased extends AbstractAccessDecisionManager - removed:
class AuthenticatedVoter implements AccessDecisionVoter - removed:
class ConsensusBased extends AbstractAccessDecisionManager - removed:
class RoleHierarchyVoter extends RoleVoter - removed:
class RoleVoter implements AccessDecisionVoter - removed:
class UnanimousBased extends AbstractAccessDecisionManager - removed:
ctor AbstractAccessDecisionManager(List) - removed:
ctor AbstractAclVoter() - removed:
ctor AffirmativeBased(List) - removed:
ctor AuthenticatedVoter() - removed:
ctor ConsensusBased(List) - removed:
ctor RoleHierarchyVoter(RoleHierarchy) - removed:
ctor RoleVoter() - removed:
ctor UnanimousBased(List) - removed:
field AbstractAccessDecisionManager.logger: Log - removed:
field AbstractAccessDecisionManager.messages: MessageSourceAccessor - removed:
method AbstractAccessDecisionManager.afterPropertiesSet(): void - removed:
method AbstractAccessDecisionManager.checkAllowIfAllAbstainDecisions(): void - removed:
method AbstractAccessDecisionManager.getDecisionVoters(): List - removed:
method AbstractAccessDecisionManager.isAllowIfAllAbstainDecisions(): boolean - removed:
method AbstractAccessDecisionManager.setAllowIfAllAbstainDecisions(boolean): void - removed:
method AbstractAccessDecisionManager.setMessageSource(MessageSource): void - removed:
method AbstractAccessDecisionManager.supports(Class): boolean - removed:
method AbstractAccessDecisionManager.supports(ConfigAttribute): boolean - removed:
method AbstractAccessDecisionManager.toString(): String - removed:
method AbstractAclVoter.getDomainObjectInstance(MethodInvocation): Object - removed:
method AbstractAclVoter.getProcessDomainObjectClass(): Class - removed:
method AbstractAclVoter.setProcessDomainObjectClass(Class): void - removed:
method AbstractAclVoter.supports(Class): boolean - removed:
method AffirmativeBased.decide(Authentication, Object, Collection): void - removed:
method AuthenticatedVoter.setAuthenticationTrustResolver(AuthenticationTrustResolver): void - removed:
method AuthenticatedVoter.supports(Class): boolean - removed:
method AuthenticatedVoter.supports(ConfigAttribute): boolean - removed:
method AuthenticatedVoter.vote(Authentication, Object, Collection): int - removed:
method ConsensusBased.decide(Authentication, Object, Collection): void - removed:
method ConsensusBased.isAllowIfEqualGrantedDeniedDecisions(): boolean - removed:
method ConsensusBased.setAllowIfEqualGrantedDeniedDecisions(boolean): void - removed:
method RoleVoter.getRolePrefix(): String - removed:
method RoleVoter.setRolePrefix(String): void - removed:
method RoleVoter.supports(Class): boolean - removed:
method RoleVoter.supports(ConfigAttribute): boolean - removed:
method RoleVoter.vote(Authentication, Object, Collection): int - removed:
method UnanimousBased.decide(Authentication, Object, Collection): void - removed:
static field AuthenticatedVoter.IS_AUTHENTICATED_ANONYMOUSLY: String - removed:
static field AuthenticatedVoter.IS_AUTHENTICATED_FULLY: String - removed:
static field AuthenticatedVoter.IS_AUTHENTICATED_REMEMBERED: String
- added:
ctor AbstractAuthenticationToken(AbstractAuthenticationToken.AbstractAuthenticationBuilder) - added:
ctor AbstractAuthenticationToken.AbstractAuthenticationBuilder(AbstractAuthenticationToken) - added:
ctor RememberMeAuthenticationToken(RememberMeAuthenticationToken.Builder) - added:
ctor RememberMeAuthenticationToken.Builder(RememberMeAuthenticationToken) - added:
ctor TestingAuthenticationToken(Object, Object, GrantedAuthority[]) - added:
ctor TestingAuthenticationToken(TestingAuthenticationToken.Builder) - added:
ctor TestingAuthenticationToken.Builder(TestingAuthenticationToken) - added:
ctor UsernamePasswordAuthenticationToken(UsernamePasswordAuthenticationToken.Builder) - added:
ctor UsernamePasswordAuthenticationToken.Builder(UsernamePasswordAuthenticationToken) - added:
method AbstractAuthenticationToken.AbstractAuthenticationBuilder.authenticated(boolean): AbstractAuthenticationToken.AbstractAuthenticationBuilder - added:
method AbstractAuthenticationToken.AbstractAuthenticationBuilder.authorities(Consumer): AbstractAuthenticationToken.AbstractAuthenticationBuilder - added:
method AbstractAuthenticationToken.AbstractAuthenticationBuilder.details(Object): AbstractAuthenticationToken.AbstractAuthenticationBuilder - added:
method RememberMeAuthenticationToken.Builder.build(): RememberMeAuthenticationToken - added:
method RememberMeAuthenticationToken.Builder.key(String): RememberMeAuthenticationToken.Builder - added:
method RememberMeAuthenticationToken.Builder.principal(Object): RememberMeAuthenticationToken.Builder - added:
method RememberMeAuthenticationToken.toBuilder(): RememberMeAuthenticationToken.Builder - added:
method TestingAuthenticationToken.Builder.build(): TestingAuthenticationToken - added:
method TestingAuthenticationToken.Builder.credentials(Object): TestingAuthenticationToken.Builder - added:
method TestingAuthenticationToken.Builder.principal(Object): TestingAuthenticationToken.Builder - added:
method TestingAuthenticationToken.toBuilder(): TestingAuthenticationToken.Builder - added:
method UsernamePasswordAuthenticationToken.Builder.build(): UsernamePasswordAuthenticationToken - added:
method UsernamePasswordAuthenticationToken.Builder.credentials(Object): UsernamePasswordAuthenticationToken.Builder - added:
method UsernamePasswordAuthenticationToken.Builder.principal(Object): UsernamePasswordAuthenticationToken.Builder - added:
method UsernamePasswordAuthenticationToken.toBuilder(): UsernamePasswordAuthenticationToken.Builder - added:
static abstract class AbstractAuthenticationToken.AbstractAuthenticationBuilder implements Authentication.Builder - added:
static class RememberMeAuthenticationToken.Builder extends AbstractAuthenticationToken.AbstractAuthenticationBuilder - added:
static class TestingAuthenticationToken.Builder extends AbstractAuthenticationToken.AbstractAuthenticationBuilder - added:
static class UsernamePasswordAuthenticationToken.Builder extends AbstractAuthenticationToken.AbstractAuthenticationBuilder
- removed:
ctor DaoAuthenticationProvider() - removed:
ctor DaoAuthenticationProvider(PasswordEncoder) - removed:
method DaoAuthenticationProvider.setUserDetailsService(UserDetailsService): void
- added:
ctor JaasAuthenticationToken(JaasAuthenticationToken.Builder) - added:
ctor JaasAuthenticationToken.Builder(JaasAuthenticationToken) - added:
method JaasAuthenticationToken.Builder.build(): JaasAuthenticationToken - added:
method JaasAuthenticationToken.Builder.loginContext(LoginContext): JaasAuthenticationToken.Builder - added:
method JaasAuthenticationToken.toBuilder(): JaasAuthenticationToken.Builder - added:
static class JaasAuthenticationToken.Builder extends UsernamePasswordAuthenticationToken.Builder
- added:
class OneTimeTokenAuthentication extends AbstractAuthenticationToken - added:
ctor OneTimeTokenAuthentication(Object, Collection) - added:
ctor OneTimeTokenAuthentication(OneTimeTokenAuthentication.Builder) - added:
ctor OneTimeTokenAuthentication.Builder(OneTimeTokenAuthentication) - added:
method OneTimeTokenAuthentication.Builder.build(): OneTimeTokenAuthentication - added:
method OneTimeTokenAuthentication.Builder.principal(Object): OneTimeTokenAuthentication.Builder - added:
method OneTimeTokenAuthentication.getCredentials(): Object - added:
method OneTimeTokenAuthentication.getPrincipal(): Object - added:
method OneTimeTokenAuthentication.toBuilder(): OneTimeTokenAuthentication.Builder - added:
static class OneTimeTokenAuthentication.Builder extends AbstractAuthenticationToken.AbstractAuthenticationBuilder
- removed:
method AuthenticatedAuthorizationManager.check(Supplier, Object): AuthorizationDecision - removed:
method AuthenticatedReactiveAuthorizationManager.check(Mono, Object): Mono - removed:
method AuthoritiesAuthorizationManager.check(Supplier, Collection): AuthorityAuthorizationDecision - removed:
method AuthorityAuthorizationManager.check(Supplier, Object): AuthorizationDecision - removed:
method AuthorityReactiveAuthorizationManager.check(Mono, Object): Mono - removed:
method AuthorizationEventPublisher.publishAuthorizationEvent(Supplier, Object, AuthorizationDecision): void - removed:
method AuthorizationManager.check(Supplier, Object): AuthorizationDecision - removed:
method AuthorizationObservationContext.getDecision(): AuthorizationDecision - removed:
method AuthorizationObservationContext.setDecision(AuthorizationDecision): void - removed:
method ObservationAuthorizationManager.check(Supplier, Object): AuthorizationDecision - removed:
method ObservationReactiveAuthorizationManager.check(Mono, Object): Mono - removed:
method ReactiveAuthorizationManager.check(Mono, Object): Mono - removed:
method SingleResultAuthorizationManager.check(Supplier, Object): AuthorizationDecision - removed:
method SpringAuthorizationEventPublisher.publishAuthorizationEvent(Supplier, Object, AuthorizationDecision): void - added:
class FactorAuthorizationDecision implements AuthorizationResult - added:
class RequiredAuthoritiesAuthorizationManager implements AuthorizationManager - added:
class RequiredFactorError implements Serializable - added:
ctor AllRequiredFactorsAuthorizationManager.Builder() - added:
ctor DefaultAuthorizationManagerFactory() - added:
ctor FactorAuthorizationDecision(List) - added:
ctor MapRequiredAuthoritiesRepository() - added:
ctor RequiredAuthoritiesAuthorizationManager(RequiredAuthoritiesRepository) - added:
ctor RequiredFactor.Builder() - added:
final class AllAuthoritiesAuthorizationManager implements AuthorizationManager - added:
final class AllAuthoritiesReactiveAuthorizationManager implements ReactiveAuthorizationManager - added:
final class AllRequiredFactorsAuthorizationManager implements AuthorizationManager - added:
final class AuthorizationManagerFactories - added:
final class ConditionalAuthorizationManager implements AuthorizationManager - added:
final class DefaultAuthorizationManagerFactory implements AuthorizationManagerFactory - added:
final class MapRequiredAuthoritiesRepository implements RequiredAuthoritiesRepository - added:
final class RequiredFactor implements Serializable - added:
interface AuthorizationManagerFactory - added:
interface RequiredAuthoritiesRepository - added:
method AllAuthoritiesAuthorizationManager.authorize(Supplier, Object): AuthorityAuthorizationDecision - added:
method AllAuthoritiesAuthorizationManager.setRoleHierarchy(RoleHierarchy): void - added:
method AllAuthoritiesReactiveAuthorizationManager.authorize(Mono, Object): Mono - added:
method AllAuthoritiesReactiveAuthorizationManager.setRoleHierarchy(RoleHierarchy): void - added:
method AllRequiredFactorsAuthorizationManager.Builder.build(): AllRequiredFactorsAuthorizationManager - added:
method AllRequiredFactorsAuthorizationManager.Builder.requireFactor(Consumer): AllRequiredFactorsAuthorizationManager.Builder - added:
method AllRequiredFactorsAuthorizationManager.Builder.requireFactor(RequiredFactor): AllRequiredFactorsAuthorizationManager.Builder - added:
method AllRequiredFactorsAuthorizationManager.authorize(Supplier, Object): FactorAuthorizationDecision - added:
method AllRequiredFactorsAuthorizationManager.setClock(Clock): void - added:
method AuthenticatedAuthorizationManager.authorize(Supplier, Object): AuthorizationResult - added:
method AuthenticatedReactiveAuthorizationManager.authorize(Mono, Object): Mono - added:
method AuthoritiesAuthorizationManager.authorize(Supplier, Collection): AuthorizationResult - added:
method AuthorityAuthorizationManager.authorize(Supplier, Object): AuthorizationResult - added:
method AuthorityReactiveAuthorizationManager.authorize(Mono, Object): Mono - added:
method AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder.build(): DefaultAuthorizationManagerFactory - added:
method AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder.requireFactor(Consumer): AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder - added:
method AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder.requireFactors(Consumer): AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder - added:
method AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder.requireFactors(String[]): AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder - added:
method AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder.when(Predicate): AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder - added:
method AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder.withWhen(Function): AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder - added:
method AuthorizationManagerFactory.anonymous(): AuthorizationManager - added:
method AuthorizationManagerFactory.authenticated(): AuthorizationManager - added:
method AuthorizationManagerFactory.denyAll(): AuthorizationManager - added:
method AuthorizationManagerFactory.fullyAuthenticated(): AuthorizationManager - added:
method AuthorizationManagerFactory.hasAllAuthorities(String[]): AuthorizationManager - added:
method AuthorizationManagerFactory.hasAllRoles(String[]): AuthorizationManager - added:
method AuthorizationManagerFactory.hasAnyAuthority(String[]): AuthorizationManager - added:
method AuthorizationManagerFactory.hasAnyRole(String[]): AuthorizationManager - added:
method AuthorizationManagerFactory.hasAuthority(String): AuthorizationManager - added:
method AuthorizationManagerFactory.hasRole(String): AuthorizationManager - added:
method AuthorizationManagerFactory.permitAll(): AuthorizationManager - added:
method AuthorizationManagerFactory.rememberMe(): AuthorizationManager - added:
method ConditionalAuthorizationManager.Builder.build(): ConditionalAuthorizationManager - added:
method ConditionalAuthorizationManager.Builder.whenFalse(AuthorizationManager): ConditionalAuthorizationManager.Builder - added:
method ConditionalAuthorizationManager.Builder.whenTrue(AuthorizationManager): ConditionalAuthorizationManager.Builder - added:
method ConditionalAuthorizationManager.authorize(Supplier, Object): AuthorizationResult - added:
method DefaultAuthorizationManagerFactory.anonymous(): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.authenticated(): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.fullyAuthenticated(): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.hasAllAuthorities(String[]): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.hasAllRoles(String[]): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.hasAnyAuthority(String[]): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.hasAnyRole(String[]): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.hasAuthority(String): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.hasRole(String): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.rememberMe(): AuthorizationManager - added:
method DefaultAuthorizationManagerFactory.setAdditionalAuthorization(AuthorizationManager): void - added:
method DefaultAuthorizationManagerFactory.setRoleHierarchy(RoleHierarchy): void - added:
method DefaultAuthorizationManagerFactory.setRolePrefix(String): void - added:
method DefaultAuthorizationManagerFactory.setTrustResolver(AuthenticationTrustResolver): void - added:
method FactorAuthorizationDecision.getFactorErrors(): List - added:
method FactorAuthorizationDecision.isGranted(): boolean - added:
method MapRequiredAuthoritiesRepository.deleteRequiredAuthorities(String): void - added:
method MapRequiredAuthoritiesRepository.findRequiredAuthorities(String): List - added:
method MapRequiredAuthoritiesRepository.saveRequiredAuthorities(String, List): void - added:
method ObservationAuthorizationManager.authorize(Supplier, Object): AuthorizationResult - added:
method ObservationReactiveAuthorizationManager.authorize(Mono, Object): Mono - added:
method RequiredAuthoritiesAuthorizationManager.authorize(Supplier, Object): AuthorizationResult - added:
method RequiredAuthoritiesRepository.findRequiredAuthorities(String): List - added:
method RequiredFactor.Builder.authority(String): RequiredFactor.Builder - added:
method RequiredFactor.Builder.authorizationCodeAuthority(): RequiredFactor.Builder - added:
method RequiredFactor.Builder.bearerTokenAuthority(): RequiredFactor.Builder - added:
method RequiredFactor.Builder.build(): RequiredFactor - added:
method RequiredFactor.Builder.casAuthority(): RequiredFactor.Builder - added:
method RequiredFactor.Builder.ottAuthority(): RequiredFactor.Builder - added:
method RequiredFactor.Builder.passwordAuthority(): RequiredFactor.Builder - added:
method RequiredFactor.Builder.samlAuthority(): RequiredFactor.Builder - added:
method RequiredFactor.Builder.validDuration(Duration): RequiredFactor.Builder - added:
method RequiredFactor.Builder.webauthnAuthority(): RequiredFactor.Builder - added:
method RequiredFactor.Builder.x509Authority(): RequiredFactor.Builder - added:
method RequiredFactor.equals(Object): boolean - added:
method RequiredFactor.getAuthority(): String - added:
method RequiredFactor.getValidDuration(): Duration - added:
method RequiredFactor.hashCode(): int - added:
method RequiredFactor.toString(): String - added:
method RequiredFactorError.equals(Object): boolean - added:
method RequiredFactorError.getRequiredFactor(): RequiredFactor - added:
method RequiredFactorError.hashCode(): int - added:
method RequiredFactorError.isExpired(): boolean - added:
method RequiredFactorError.isMissing(): boolean - added:
method RequiredFactorError.toString(): String - added:
method SpringAuthorizationEventPublisher.setShouldPublishResult(Predicate): void - added:
static class RequiredFactor.Builder - added:
static final class AllRequiredFactorsAuthorizationManager.Builder - added:
static final class AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder - added:
static final class ConditionalAuthorizationManager.Builder - added:
static method AllAuthoritiesAuthorizationManager.hasAllAuthorities(List): AllAuthoritiesAuthorizationManager - added:
static method AllAuthoritiesAuthorizationManager.hasAllAuthorities(String[]): AllAuthoritiesAuthorizationManager - added:
static method AllAuthoritiesAuthorizationManager.hasAllPrefixedAuthorities(String, String[]): AllAuthoritiesAuthorizationManager - added:
static method AllAuthoritiesAuthorizationManager.hasAllRoles(String[]): AllAuthoritiesAuthorizationManager - added:
static method AllAuthoritiesReactiveAuthorizationManager.hasAllAuthorities(String[]): AllAuthoritiesReactiveAuthorizationManager - added:
static method AllAuthoritiesReactiveAuthorizationManager.hasAllPrefixedAuthorities(String, String[]): AllAuthoritiesReactiveAuthorizationManager - added:
static method AllAuthoritiesReactiveAuthorizationManager.hasAllRoles(String[]): AllAuthoritiesReactiveAuthorizationManager - added:
static method AllRequiredFactorsAuthorizationManager.anyOf(AllRequiredFactorsAuthorizationManager[]): AuthorizationManager - added:
static method AllRequiredFactorsAuthorizationManager.builder(): AllRequiredFactorsAuthorizationManager.Builder - added:
static method AuthorizationManagerFactories.multiFactor(): AuthorizationManagerFactories.AdditionalRequiredFactorsBuilder - added:
static method ConditionalAuthorizationManager.when(Predicate): ConditionalAuthorizationManager.Builder - added:
static method RequiredFactor.builder(): RequiredFactor.Builder - added:
static method RequiredFactor.withAuthority(String): RequiredFactor.Builder - added:
static method RequiredFactorError.createExpired(RequiredFactor): RequiredFactorError - added:
static method RequiredFactorError.createMissing(RequiredFactor): RequiredFactorError
- removed:
ctor AuthorizationDeniedEvent(Supplier, Object, AuthorizationDecision) - removed:
ctor AuthorizationGrantedEvent(Supplier, Object, AuthorizationDecision) - removed:
method AuthorizationEvent.getAuthorizationDecision(): AuthorizationDecision
- removed:
class ExpressionAttributeAuthorizationDecision extends AuthorizationDecision - removed:
ctor ExpressionAttributeAuthorizationDecision(boolean, ExpressionAttribute) - removed:
ctor PrePostTemplateDefaults() - removed:
final class PrePostTemplateDefaults - removed:
method ExpressionAttributeAuthorizationDecision.getExpressionAttribute(): ExpressionAttribute - removed:
method ExpressionAttributeAuthorizationDecision.toString(): String - removed:
method Jsr250AuthorizationManager.check(Supplier, MethodInvocation): AuthorizationDecision - removed:
method MethodExpressionAuthorizationManager.check(Supplier, MethodInvocation): AuthorizationDecision - removed:
method PostAuthorizeAuthorizationManager.check(Supplier, MethodInvocationResult): AuthorizationDecision - removed:
method PostAuthorizeAuthorizationManager.setTemplateDefaults(PrePostTemplateDefaults): void - removed:
method PostAuthorizeReactiveAuthorizationManager.check(Mono, MethodInvocationResult): Mono - removed:
method PostAuthorizeReactiveAuthorizationManager.setTemplateDefaults(PrePostTemplateDefaults): void - removed:
method PostFilterAuthorizationMethodInterceptor.setTemplateDefaults(PrePostTemplateDefaults): void - removed:
method PostFilterAuthorizationReactiveMethodInterceptor.setTemplateDefaults(PrePostTemplateDefaults): void - removed:
method PreAuthorizeAuthorizationManager.check(Supplier, MethodInvocation): AuthorizationDecision - removed:
method PreAuthorizeAuthorizationManager.setTemplateDefaults(PrePostTemplateDefaults): void - removed:
method PreAuthorizeReactiveAuthorizationManager.check(Mono, MethodInvocation): Mono - removed:
method PreAuthorizeReactiveAuthorizationManager.setTemplateDefaults(PrePostTemplateDefaults): void - removed:
method PreFilterAuthorizationMethodInterceptor.setTemplateDefaults(PrePostTemplateDefaults): void - removed:
method PreFilterAuthorizationReactiveMethodInterceptor.setTemplateDefaults(PrePostTemplateDefaults): void - removed:
method PrePostTemplateDefaults.isIgnoreUnknown(): boolean - removed:
method PrePostTemplateDefaults.setIgnoreUnknown(boolean): void - removed:
method SecuredAuthorizationManager.check(Supplier, MethodInvocation): AuthorizationDecision - added:
ctor NullReturningMethodAuthorizationDeniedHandler() - added:
final class NullReturningMethodAuthorizationDeniedHandler implements MethodAuthorizationDeniedHandler - added:
method Jsr250AuthorizationManager.authorize(Supplier, MethodInvocation): AuthorizationResult - added:
method MethodExpressionAuthorizationManager.authorize(Supplier, MethodInvocation): AuthorizationResult - added:
method NullReturningMethodAuthorizationDeniedHandler.handleDeniedInvocation(MethodInvocation, AuthorizationResult): Object - added:
method NullReturningMethodAuthorizationDeniedHandler.handleDeniedInvocationResult(MethodInvocationResult, AuthorizationResult): Object - added:
method PostAuthorizeAuthorizationManager.authorize(Supplier, MethodInvocationResult): AuthorizationResult - added:
method PostAuthorizeReactiveAuthorizationManager.authorize(Mono, MethodInvocationResult): Mono - added:
method PreAuthorizeAuthorizationManager.authorize(Supplier, MethodInvocation): AuthorizationResult - added:
method PreAuthorizeReactiveAuthorizationManager.authorize(Mono, MethodInvocation): Mono - added:
method SecuredAuthorizationManager.authorize(Supplier, MethodInvocation): AuthorizationResult
- added:
interface Authentication.Builder - added:
method Authentication.Builder.authenticated(boolean): Authentication.Builder - added:
method Authentication.Builder.authorities(Consumer): Authentication.Builder - added:
method Authentication.Builder.build(): Authentication - added:
method Authentication.Builder.credentials(Object): Authentication.Builder - added:
method Authentication.Builder.details(Object): Authentication.Builder - added:
method Authentication.Builder.principal(Object): Authentication.Builder - added:
method Authentication.toBuilder(): Authentication.Builder
- added:
interface ExpressionTemplateValueProvider - added:
method ExpressionTemplateValueProvider.getExpressionTemplateValue(): String
- added:
final class FactorGrantedAuthority implements GrantedAuthority - added:
method FactorGrantedAuthority.Builder.build(): FactorGrantedAuthority - added:
method FactorGrantedAuthority.Builder.issuedAt(Instant): FactorGrantedAuthority.Builder - added:
method FactorGrantedAuthority.equals(Object): boolean - added:
method FactorGrantedAuthority.getAuthority(): String - added:
method FactorGrantedAuthority.getIssuedAt(): Instant - added:
method FactorGrantedAuthority.hashCode(): int - added:
method FactorGrantedAuthority.toString(): String - added:
static field FactorGrantedAuthority.AUTHORIZATION_CODE_AUTHORITY: String - added:
static field FactorGrantedAuthority.BEARER_AUTHORITY: String - added:
static field FactorGrantedAuthority.CAS_AUTHORITY: String - added:
static field FactorGrantedAuthority.OTT_AUTHORITY: String - added:
static field FactorGrantedAuthority.PASSWORD_AUTHORITY: String - added:
static field FactorGrantedAuthority.SAML_RESPONSE_AUTHORITY: String - added:
static field FactorGrantedAuthority.WEBAUTHN_AUTHORITY: String - added:
static field FactorGrantedAuthority.X509_AUTHORITY: String - added:
static final class FactorGrantedAuthority.Builder - added:
static method FactorGrantedAuthority.fromAuthority(String): FactorGrantedAuthority - added:
static method FactorGrantedAuthority.fromFactor(String): FactorGrantedAuthority - added:
static method FactorGrantedAuthority.withAuthority(String): FactorGrantedAuthority.Builder - added:
static method FactorGrantedAuthority.withFactor(String): FactorGrantedAuthority.Builder
- added:
method UsernameNotFoundException.getName(): String - added:
static field ReactiveUserDetailsPasswordService.NOOP: ReactiveUserDetailsPasswordService - added:
static field UserDetailsPasswordService.NOOP: UserDetailsPasswordService - added:
static method UsernameNotFoundException.fromUsername(String): UsernameNotFoundException - added:
static method UsernameNotFoundException.fromUsername(String, Throwable): UsernameNotFoundException
- added:
abstract class SecurityJacksonModule extends SimpleModule - added:
abstract class SimpleGrantedAuthorityMixin - added:
class CoreJacksonModule extends SecurityJacksonModule - added:
ctor CoreJacksonModule() - added:
ctor CoreJacksonModule(String, Version) - added:
ctor SecurityJacksonModule() - added:
ctor SecurityJacksonModule(String, Version) - added:
ctor SimpleGrantedAuthorityMixin(String) - added:
final class SecurityJacksonModules - added:
method CoreJacksonModule.configurePolymorphicTypeValidator(BasicPolymorphicTypeValidator.Builder): void - added:
method CoreJacksonModule.setupModule(JacksonModule.SetupContext): void - added:
method SecurityJacksonModule.configurePolymorphicTypeValidator(BasicPolymorphicTypeValidator.Builder): void - added:
static method SecurityJacksonModules.getModules(ClassLoader): List - added:
static method SecurityJacksonModules.getModules(ClassLoader, BasicPolymorphicTypeValidator.Builder): List
- changed:
class JdbcUserDetailsManager extends JdbcDaoImpl implements UserDetailsManager, GroupManager → class JdbcUserDetailsManager extends JdbcDaoImpl implements UserDetailsManager, GroupManager, UserDetailsPasswordService - added:
method JdbcUserDetailsManager.setEnableUpdatePassword(boolean): void - added:
method JdbcUserDetailsManager.updatePassword(UserDetails, String): UserDetails
- added:
ctor InetAddressMatchers.Builder() - added:
final class InetAddressMatchers - added:
interface InetAddressMatcher - added:
method InetAddressMatcher.matches(InetAddress): boolean - added:
method InetAddressMatcher.matches(String): boolean - added:
method InetAddressMatchers.Builder.build(): InetAddressMatcher - added:
method InetAddressMatchers.Builder.excludeAddresses(List): InetAddressMatchers.Builder - added:
method InetAddressMatchers.Builder.includeAddresses(List): InetAddressMatchers.Builder - added:
method InetAddressMatchers.Builder.matchAll(InetAddressMatcher[]): InetAddressMatchers.Builder - added:
method InetAddressMatchers.Builder.reportOnly(): InetAddressMatchers.Builder - added:
static final class InetAddressMatchers.Builder - added:
static method InetAddressMatchers.builder(): InetAddressMatchers.Builder - added:
static method InetAddressMatchers.fromIpAddress(String): InetAddressMatcher - added:
static method InetAddressMatchers.matchExternal(): InetAddressMatchers.Builder - added:
static method InetAddressMatchers.matchInternal(): InetAddressMatchers.Builder