Expected BehaviorFormLogin should be configurable to take in username and password as a predefined json object.Current B...

Expected BehaviorNimbusJwtEncoder should allow the user to specify whether it should generate JWT access tokens complyin...

Describe the bugIn Spring Security 7, a NimbusJwtEncoder constructed by private NimbusJwtEncoder(JWK jwk) produces Jwt o...

https://github.com/spring-projects/spring-security/blob/9126aaf19b33d7cfa4494fa2b9ccf2918f50e62b/oauth2/oauth2-authoriza...

Expected BehaviorThe default behaviour of the AuthenticationSuccessHandler and AuthenticationFailureHandlers should be a...

I have a spring boot 4 app with an oauth2 client registration, that is configured with refresh_token for the authorizati...

We use this guide to create a custom grant type for our CIBA use case but we found a potential problem in enriching the ...

Describe the bugUpgrading from 6.x to 7.0, the org.springframework.security.access package has now been @NullMarked.The ...

Currently the methods in org.springframework.security.oauth2.server.authorization.web.authentication.OAuth2EndpointUtils...

Describe the bugWhile running into the common(?) 'Read timed out' error I tried to follow the common advise of providing...

Related to #18195, we should add detail in the migration guide about how extend the socket timeout values.

HttpSecurity on 7.0 added oauth2AuthorizationServer method, but HttpSecurityDsl missing thathttps://github.com/spring-pr...

Describe the bugIf I grant a user the .....W permission (mask 3) and check it against a document I annotated with @PreAu...

Describe the bugorg.springframework.security.web.FilterChainProxy.getFilters(String) throws NPE in Spring Security 6.5.6...

Document how the switch to Jackson 3 is a breaking change. For example, users with custom Security classes that are mapp...

Summary: Spring Security only detects a CorsConfigurationSource bean by name "corsConfigurationSource", causing silent C...

Expected BehaviorWhen Enabling MFA, OAuth2 auhorization flows should (optionally) first get MFA validated, then continue...

Hi, In a plain oauth2Login() application (keycloak as IDP for example), after https://github.com/spring-projects/spring-...

Describe the bugWhen used as a single factor, WebAuthn login works.Used as a second factor, WebAuthn login fails, becaus...

Spring Boot Version3.5.7Describe the bugSuppose we havepublic class CustomBaseJpaRepositoryFactoryBean<T extends Repo...