Spring Security v5.2.0.RC1 Release Notes
Release Date: 2019-09-06 // over 4 years ago-
π± βοΈ New Features
- β Add attributes Consumer to OAuth2AuthorizationContext #7385
- π Improve DefaultReactiveOAuth2UserService handling IOException #7370
- β Add RSocket Support #7360
- π Polish Server|ServletBearerExchangeFilterFunction #7355
- π¨ Refactor Servlet/Server BearerExchangeFilterFunction #7353
- π OAuth2AuthorizeRequest supports attributes #7352
- π Grant Individual Authorities From Claims #7351
- π DefaultOAuth2AuthorizedClientManager and DefaultServerOAuth2AuthorizedClientManager Alignment #7350
- π Align Servlet ClearSiteData expression of directives #7347
- β Add Adapter to Translate Jwt to BearerTokenAuthentication #7346
- π Opaque Token Introspector should return an Authenticated Principal #7345
- π Opaque Token Introspection Strategy Flexibility #7344
- β Add BearerTokenAuthentication #7343
- β Add OAuth2AuthenticatedPrincipal #7342
- π OAuth2AuthorizeRequest supports attributes #7341
- π DefaultOAuth2UserService should extract authorities #7339
- π InMemoryReactiveClientRegistrationRepository should check for duplicates #7338
- β Add Servlet and ServerBearerExchangeFilterFunction #7330
- β‘οΈ Update to Gradle 5.6.1 #7323
- π Simplify and improve the buildSrc gradle plugin #7302
- β‘οΈ Update to Gradle 5.6 #7300
- β Add Catalan localization messages #7288
- β Add Catalan localization messages #7287
- π Resource Server should support WebClient Bearer Token propagation #7284
- π Sample should use UserDetailsService bean instead of configureGlobal method #7283
- π Mock Jwt Test Samples #7278
- π Allow to set default securityContextRepository for each authenticatioβ¦ #7275
- π Resource Server Multi-tenancy Sample Should Manage Its Own Jwt Decoder #7272
- β Add setter for authorities claim name in JwtGrantedAuthoritiesConverter #7271
- π Jwk Set Uri Nimbus Jwt Decoder builders should take SignatureAlgorithm #7270
- β Add setContentLengthLong detection to OnCommittedResponseWrapper. #7264
- π Consolidate shared code between JwtDecoders and ReactiveJwtDecoders #7263
- β Remove MultiTenantAuthenticationManagerResolver #7259
- β Add setter for authority prefix in JwtGrantedAuthoritiesConverter #7256
- π Prevent IntelliJ IDEA from generating spaces for indentation #7253
- π TokenBasedRememberMeServices.processAutoLoginCookie (TokenBasedRememberMeServices.java:134) java.lang.NullPointerException #7251
- π Authentication Mechanisms Should Default their ServerSecurityContextRepository #7249
- π Rename OAuth2TokenIntrospectionClient #7246
- π Consider renaming OAuth2TokenIntrospectionClient #7245
- β Add OAuth2LoginSpec#securityContextRepository #7244
- π Cleanup Code Style Issues #7238
- β Add Checkstyle configuration for IntelliJ IDEA #7237
- π Expose getPort in ApacheDsContainer #7236
- π OAuth2LoginConfigurer should discover OAuth2UserService beans #7232
- π Make ldap integration tests independent #7231
- β Remove unused imports #7229
- π ServerHttpSecurity: oauth2Login() ignores securityContextRepository() #7222
- π Use the 'io.freefair.aspectj' gradle plugin #7183
- β Add RequestMatcher.matcher(HttpServletRequest) #7172
- π ignore Multipart requests in HttpSessionRequestCache.requestMatcher #7167
- β Add test examples for Oauth2 Resource Server sample #7159
- β Add unbounid support in xml #7149
- π OAuth2AuthorizedClientManager implementation works outside of request #7122
- π Improve OAuth2 Resource Server tests #7118
- π Introduce Reactive OAuth2AuthorizedClient Manager/Provider #7116
- π Allow configurable Clock in OAuth2AuthorizedClientProvider impls #7114
- π JwtGrantedAuthoritiesConverter should allow configuring the authority prefix #7101
- π JwtGrantedAuthoritiesConverter should allow configuring the authorities claim name #7100
- β Add authenticationFailureHandler method in OAuth2LoginSpec #7071
- π v5.2.0.M3 docs contain Deprecated example code #7062
- π Multipartfile request with no authentication is still consumed even after an AccessDeniedException is thrown #7060
- β Add OAuth2LoginSpec.authenticationFailureHandler #7051
- β Add Argon2PasswordEncoder #7045
- π Fix docs typo WebSecurityConfigurationAdapter->WebSecurityConfigurerAdapter #7026
- β Add support for Resource Owner Password Credentials grant #7013
- π Jwt decoding should support multiple algorithms #6883
- π Polish Resource Server DSL Error Messaging #6876
- β Remove Invalid WebMvcConfigurer from Sample Documentation #6822
- π Align code in oauth2-client extensions for WebClient #6811
- π OAuth2 Client Credentials Flow: Getting access tokens in the service/data tier #6780
- π Provide Servlet equivalent of UnAuthenticatedServerOAuth2AuthorizedClientRepository #6683
- π Spring Boot + spring-security-oauth2-resource-server should not throw a ClassNotFoundException once it supports more than one token format #6209
- π Support Resource Owner Password Credentials grant #6003
- β Add Argon2PasswordEncoder #5354
- β Add BearerExchangeFilterFunction #5334
π± π Bug Fixes
- β Remove package tangle in headers #7380
- β Remove OAuth2AuthorizationRequest when a distributed session is used #7334
- π OAuth2AuthorizationRequest not removed from session #7327
- π Use ConcurrentHashMap in InMemoryReactiveClientRegistrationRepository #7308
- π fix footnotes markup #7305
- β add media type jwk-set+json to accept header #7304
- π InMemoryReactiveClientRegistrationRepository should not use ConcurrentReferenceHashMap #7299
- π Fix WebClient Memory Leaks #7293
- π NimbusJwtDecoderJwkSupport only sets 'application/json' Accept header #7290
- π Fix typo in docs #7277
- π Fix UserDetailsPasswordService JavaDoc #7266
- π Ensure filter order is maintained when using springSecurity() along with other filters #7265
- π OnCommittedResponseWrapper fails on static resources served by Tomcat 8.5 #7261
- π Expire as many sessions as exceed maximum allowed #7258
- π Use UTF-8 for compilation #7254
- π Fix NPE in RequestContextSubscriber #7235
- π RequestContextSubscriber could put null value in Reactor Context #7228
- π Fix docs typo WebSecurityConfigurationAdapter->WebSecurityConfigurerAdapter #7181
- π SessionRegistryImpl uses Map.compute #7178
- π SessionAuthenticationStrategy make HttpSecurity.sessionManagement().maximumSessions(1) unavailability #7166
- π Misleading documentation for websocket security #4845
- π SEC-2980: Possible race condition in SessionRegistryImpl #3189
- π SEC-2971: Footnotes are messed up in online docs #3180
β¬οΈ π¨ Dependency Upgrades
- β‘οΈ Update to Gretty 2.3.1 #7389
- β‘οΈ Update to OpenSaml 3.3.1 #7388
- β‘οΈ Update to cglib 3.3.0 #7387
- β‘οΈ Update to Spring Data Moore RC3 #7386
- β‘οΈ Update to Spring Framework 5.2.0.RC2 #7371
- β‘οΈ Update to Spring Boot 2.2.0.M5 #7320
- β‘οΈ Update to org.seleniumhq.selenium:htmlunit-driver 2.36.0 #7319
- β‘οΈ Update to hibernate-entitymanager 5.4.4.Final #7318
- β‘οΈ Update to net.sourceforge.htmlunit:htmlunit 2.36.0 #7317
- β‘οΈ Update to commons-codec 1.13 #7316
- β‘οΈ Update to nimbus-jose-jwt 7.8 #7315
- β‘οΈ Update to GAE 1.9.76 #7314
π± β€οΈ Contributors
π We'd like to thank all the contributors who worked on this release!