Superseded by https://github.com/spring-projects/spring-framework/issues/33789Related https://github.com/spring-cloud/s...

Spring Security often uses GenericHttpMessageConverter for JSON support. The new Jackson support was refined to be a Sma...

DescriptionThe Spring Security reference guide is currently available only as HTML athttps://docs.spring.io/spring-secur...

Describe the bugI use AD to authenticate user which works as expected. I have class like below:Note that I have enabled...

Most of the coverage classes under AbstractSecurityInterceptorTests are deprecated or moved to MethodSecurityInterceptor...

RegexRequestMatcher.regexMatcher(HttpMethod method, String pattern) says in the Javadoc that method "May be null to matc...

Describe the bugrequests:http://127.0.0.1/http://127.0.0.1/oauth2/authorization/gatewayhttp://localhost:8080/oauth2/auth...

Currently, to specify a time-sensitive factor, it is needed to create an AuthorizationManagerFactory by way of a static ...

Describe the bugWe encountered repeating, but not easily reproducible bug ending with StackOverflowError caught and logg...

Align the defaults applied in OidcUserService.setRetrieveUserInfo() and OidcReactiveOAuth2UserService.setRetrieveUserInf...

It's misspelled. We cannot just remove it since it is public, so we should deprecate it in favor of the correct spelling...

This is quite possibly a bug in the underlying component(s), but the following test will fail:this.webTestClient .get...

DelegatingMissingAuthorityAccessDeniedHandler only sets a single missing authority while DefaultLoginPageGeneratingFilt...

Calling SecurityContextHolder.setStrategyName(strategy) with any strategy name breaks spring filters because of code lik...

Related to #18021, it would be nice if Authentication.Builder could merge authorities on its own. One way to do this is ...

Introducing Authentication#toBuilder and using it on each filter means that any application using a custom authenticatio...

Could you please at least update "oauth2-oidc-sdk:9.43.6" dependency to a more recent version in "spring-security-oauth2...

Expected BehaviorTo not throw an exception and create Map<String, ClientRegistration> properlyCurrent BehaviorThro...

Expected BehaviorIt should be possible to customize refresh token and DPoP binding, so engineers can use any binding sch...

While it is not possible to automatically enable WebauthnJackson2Module in SecurityJackson2Modules due to the global def...