Skip to content

Releases: spring-projects/spring-security

5.7.0-M1

14 Jan 20:19
@sjohnr sjohnr
5.7.0-M1
a8457b5
Compare
Choose a tag to compare
5.7.0-M1 Pre-release
Pre-release

⏪ Breaking Changes

  • Saml2 metadata includes SingleLogoutService even if saml2 logout is disabled / not configured #10607

⭐ New Features

  • Add Cross-Origin-Opener-Policy and Cross-Origin-Embedder-Policy security headers #9385
  • Add Cross-Origin-Resource-Policy security header #10118
  • Add Cross Origin Policies headers DSL support #10141
  • Add hasIpAddress to Reactive Kotlin DSL #10571
  • Add ObjectIdentityGenerator customization to JdbcAclService #10081
  • Add RedirectStrategy customization to ChannelSecurityConfigurer for R… #10161
  • Allow custom OAuth2ErrorHttpMessageConverter with OAuth2ErrorResponseErrorHandler #10425
  • Allow custom OAuth2ErrorHttpMessageConverter with OAuth2ErrorResponse… #10432
  • Avoid using SpEL to change the meaning of the injection point #10075
  • BasicLookupStrategy for ACL defines the ObjectIdentity as not interchangable #10079
  • Clarify behaviour of enableSessionUrlRewriting #7644
  • Client JwtBearer grant type should support non Jwt principal #9812
  • Fix CsrfConfigurer default AccessDeniedHandler consistency #10154
  • Fix Gradle Deprecation Warnings #10446
  • Fix typo in Expression matcher Javadocs #10688
  • HttpServlet3RequestFactory should set 'details' when creating the authentication token. #9579
  • Introduce AuthorizationManagerWebInvocationPrivilegeEvaluator #10590
  • Prevent using both authorizeRequests and authorizeHttpRequests #10574
  • Prevent using both authorizeRequests and authorizeHttpRequests #10573
  • Provide Jackson serialization support for LDAP classes #9263
  • Set 'details' on authentication token created by HttpServlet3RequestFactory #9597
  • Spring Security WebFlux IP Whitelist #7765
  • Structure101 plugin should retrive most recent binary #10696
  • Support for changing prefix and suffix in DelegatingPasswordEncoder #10278
  • Support IP whitelist for Spring Security Webflux #10007
  • Update Spring Security to 5.7 #10509

🪲 Bug Fixes

  • #10505 Fixed jwtDecoder example code #10510
  • AuthorityAuthorizationManager incorrectly compares GrantedAuthority #10566
  • WebInvocationPrivilegeEvaluator Bean should support multiple SecurityFilterChains #10554
  • A null SingleLogoutServiceLocation should not cause a NullPointerException #10674
  • clockSkew Javadoc is not consistent with implementation #10174
  • Configure WebInvocationPrivilegeEvaluator for multiple SecurityFilterChains #10575
  • Fix case sensitive headers comparison #10578
  • Fix Reactive OAuth2 Kotlin DSL examples #10586
  • Fix the bug that the custom GrantedAuthority comparison fails #10588
  • Kotlin DSL examples in reactive oauth2 docs call build twice #10580
  • Make source code compatible with JDK 8 #10695
  • Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10505
  • Prevent Save @Transient Authentication with existing HttpSession #9993
  • StaticServerHttpHeadersWriter should work with case-insensitive header names #10557
  • Update clockSkew javadoc according to implementation #10358

🔨 Dependency Upgrades

  • Update aspectj-plugin to 6.3.0 #10514
  • Update aspectj-plugin to 6.3.0 #10492
  • Update assertj-core to 3.22.0 #10720
  • Update cas-client-core to 3.6.4 #10723
  • Update com.nimbusds to 9.22 #10713
  • Update hibernate-entitymanager to 5.6.3.Final #10722
  • Update htmlunit to 2.56.0 #10718
  • Update htmlunit-driver to 2.56.0 #10728
  • Update io.projectreactor to 2020.0.15 #10715
  • Update io.r2dbc to 0.9.0.RELEASE #10717
  • Update jackson-bom to 2.13.1 #10710
  • Update jackson-databind to 2.13.1 #10711
  • Update jackson-datatype-jsr310 to 2.13.1 #10712
  • Update junit-bom to 5.8.2 #10726
  • Update logback-classic to 1.2.10 #10709
  • Update mockk to 1.12.2 #10714
  • Update org.aspectj to 1.9.8.RC3 #10719
  • Update org.bouncycastle to 1.70 #10721
  • Update org.jetbrains.kotlin to 1.6.10 #10724
  • Update org.jetbrains.kotlinx to 1.6.0 #10725
  • Update org.junit.jupiter to 5.8.2 #10727
  • Update org.slf4j to 1.7.33 #10729
  • Update org.springframework to 5.3.15 #10730
  • Update org.springframework.data to 2021.2.0-M1 #10731
  • Update reactor-netty to 1.0.15 #10716
  • Update spring-ldap-core to 2.4.0-M1 #10732

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

Loading

5.6.1

20 Dec 21:17
@sjohnr sjohnr
5.6.1
e38bf6e
Compare
Choose a tag to compare
5.6.1

⭐ New Features

  • Document authentication helper method in WebClient integration #10468
  • Document authentication helper method in WebClient integration for Servlet Environments #10120
  • Document parameters converter in oauth2 client servlet docs #10469
  • Document parameters converter in oauth2 client servlet docs #10467

🪲 Bug Fixes

  • AuthorityAuthorizationManager incorrectly compares GrantedAuthority #10595
  • clockSkew Javadoc is not consistent with implementation #10535
  • Invalid_request failures in JwtTokenValidators are always turned into invalid_token errors #10560
  • Kotlin DSL examples in reactive oauth2 docs call build twice #10591
  • StaticServerHttpHeadersWriter should work with case-insensitive header names #10581

🔨 Dependency Upgrades

  • Update cas-client-core to 3.6.4 #10654
  • Update hibernate-entitymanager to 5.6.3.Final #10653
  • Update io.projectreactor to 2020.0.14 #10651
  • Update jackson-bom to 2.13.1 #10647
  • Update jackson-databind to 2.13.1 #10648
  • Update jackson-datatype-jsr310 to 2.13.1 #10649
  • Update junit-bom to 5.8.2 #10656
  • Update logback-classic to 1.2.9 #10646
  • Update mockk to 1.12.1 #10650
  • Update org.jetbrains.kotlin to 1.5.32 #10655
  • Update org.junit.jupiter to 5.8.2 #10657
  • Update org.springframework to 5.3.14 #10658
  • Update reactor-netty to 1.0.14 #10652
  • Update spring-ldap-core to 2.3.5.RELEASE #10659

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

Loading

5.5.4

20 Dec 14:16
@marcusdacoregio marcusdacoregio
5.5.4
5bc0537
Compare
Choose a tag to compare
5.5.4

🪲 Bug Fixes

  • Documentation has wrong code example in the 'Customizing OpenSAML’s AuthnRequest Instance' section #10527
  • Invalid_request failures in JwtTokenValidators are always turned into invalid_token errors #10561
  • MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10531
  • Multi-tenancy Documentation - com.nimbusds.jwt.proc.JWTProcessor does not have a setJWTClaimSetJWSKeySelector method #10520
  • Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10516
  • Oauth2 Resource Server will not retry on first failure with Multi-tenancy #10484
  • StaticServerHttpHeadersWriter should work with case-insensitive header names #10582
  • WebInvocationPrivilegeEvaluator does not provide a way to pass a ServletContext #10435

🔨 Dependency Upgrades

  • Update cas-client-core to 3.6.4 #10637
  • Update hibernate-entitymanager to 5.4.33 #10635
  • Update hsqldb to 2.6.1 #10636
  • Update io.projectreactor to 2020.0.14 #10633
  • Update io.spring.javaformat to 0.0.29 #10411
  • Update jackson-bom to 2.12.6 #10630
  • Update jackson-databind to 2.12.6 #10631
  • Update jackson-datatype-jsr310 to 2.12.6 #10632
  • Update logback-classic to 1.2.9 #10629
  • Update org.jetbrains.kotlin to 1.5.32 #10638
  • Update org.springframework to 5.3.14 #10639
  • Update org.springframework.data to 2021.0.7 #10640
  • Update reactor-netty to 1.0.14 #10634
  • Update spring-ldap-core to 2.3.5.RELEASE #10641
Loading

5.4.10

20 Dec 19:54
@marcusdacoregio marcusdacoregio
5.4.10
f9989bf
Compare
Choose a tag to compare
5.4.10

🪲 Bug Fixes

  • StaticServerHttpHeadersWriter should work with case-insensitive header names #10583
  • Invalid_request failures in JwtTokenValidators are always turned into invalid_token errors #10562
  • MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10532
  • Documentation has wrong code example in the 'Customizing OpenSAML’s AuthnRequest Instance' section #10528
  • Multi-tenancy Documentation - com.nimbusds.jwt.proc.JWTProcessor does not have a setJWTClaimSetJWSKeySelector method #10521
  • Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10517
  • Oauth2 Resource Server will not retry on first failure with Multi-tenancy #10485
  • WebInvocationPrivilegeEvaluator does not provide a way to pass a ServletContext #10437
Loading

5.3.13.RELEASE

20 Dec 20:23
@eleftherias eleftherias
5.3.13.RELEASE
3527cd9
Compare
Choose a tag to compare
5.3.13.RELEASE

🪲 Bug Fixes

  • Reactive resource server tests failing #10660
  • Gretty samples fail when using logback 1.2.9 #10643
  • StaticServerHttpHeadersWriter should work with case-insensitive header names #10584
  • Invalid_request failures in JwtTokenValidators are always turned into invalid_token errors #10563
  • MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10533
  • Multi-tenancy Documentation - com.nimbusds.jwt.proc.JWTProcessor does not have a setJWTClaimSetJWSKeySelector method #10522
  • Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10518
  • Oauth2 Resource Server will not retry on first failure with Multi-tenancy #10486

🔨 Dependency Upgrades

  • Update to AspectJ 1.9.7 #10645
  • Update to Google App Engine 1.9.93 #10644
Loading

5.2.15.RELEASE

20 Dec 19:20
@eleftherias eleftherias
5.2.15.RELEASE
60e1db1
Compare
Choose a tag to compare
5.2.15.RELEASE

🔨 Dependency Upgrades

  • Update logback to 1.2.9 #10642
Loading

5.2.14.RELEASE

20 Dec 17:35
@eleftherias eleftherias
5.2.14.RELEASE
3f7041a
Compare
Choose a tag to compare
5.2.14.RELEASE

🪲 Bug Fixes

  • StaticServerHttpHeadersWriter should work with case-insensitive header names #10585
  • MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10534
  • Multi-tenancy Documentation - com.nimbusds.jwt.proc.JWTProcessor does not have a setJWTClaimSetJWSKeySelector method #10523
  • Multi-tenancy Documentation - JwtDecoder sample has multiple errors #10519

🔨 Dependency Upgrades

  • Update to GAE 1.9.93 #10628
  • Upgrade httpmime to 4.5.13 #10627
  • Upgrade httpcore to 4.4.15 #10626
  • Upgrade attoparser to 2.0.5.RELEASE #10625
  • Update to hibernate-entitymanager 5.4.33 #10624
  • Upgrade jboss logging to 3.3.3.Final #10623
  • Upgrade jboss jandex to 2.0.5.Final #10622
  • Upgrade Unbescape to 1.1.6.RELEASE #10621
  • Update to thymeleaf-spring5 3.0.14 #10620
  • Update to embedded Tomcat websocket 8.5.73 #10619
  • Upgrade to embedded Apache Tomcat 9.0.56 #10618
  • Upgrade Reactor to Dysprosium-SR25 #10617
  • Upgrade Spring Framework to 5.2.19.RELEASE #10616
Loading

5.6.0

16 Nov 17:22
@jzheaux jzheaux
5.6.0
fa628f7
Compare
Choose a tag to compare
5.6.0

⭐ New Features

  • DaoAuthenticationProviderTests#avg function doesn't return fraction #10426
  • Docs Should Use Section Summary #10449
  • MissingCsrfTokenException message is misleading when not storing the CSRF tokens in the session #10436
  • Revamp OAuth 2.0 Login/Client reactive documentation #8174
  • Revamp Reactive OAuth 2.0 Login documentation #10479
  • Split up Documentation Further #10367
  • Support Structure 101 License Id in Package Tangle Check #10443

🪲 Bug Fixes

  • Adding keyInfo section to LogoutRequest from RP side #10450
  • In saml2 LogoutRequest from RP doesn't contain KeyInfo #10438
  • Oauth2 Resource Server will not retry on first failure with Multi-tenancy #10444
  • Port Missing Integration Docs #10465
  • SAML 2.0 JUnit Tests are being skipped #10215
  • Various build time javadoc warnings fix #10423

🔨 Dependency Upgrades

  • Update aspectj-plugin to 6.2.0 #10445
  • Update com.nimbusds to 9.19 #10491
  • Update hibernate-entitymanager to 5.6.1.Final #10495
  • Update hsqldb to 2.6.1 #10496
  • Update io.projectreactor to 2020.0.13 #10493
  • Update logback-classic to 1.2.7 #10490
  • Update org.springframework to 5.3.13 #10497
  • Update reactor-netty to 1.0.13 #10494

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

Loading

5.6.0-RC1

19 Oct 02:33
@rwinch rwinch
5.6.0-RC1
38691e6
Compare
Choose a tag to compare
5.6.0-RC1 Pre-release
Pre-release

⏪ Breaking Changes

  • Conditionally resolve bearer token from request parameters #10340
  • DefaultBearerTokenResolver triggers processing of multipart content #10326
  • getClaimAsBoolean should not be falsy #10148
  • getClaimAsBoolean() should not be falsy #10356

⭐ New Features

  • Add saml2.ValidIssuers parameter into SAML 2.0 Assertion Validators #10335
  • Add parameters converter support to AbstractWebClientReactiveOAuth2AccessTokenResponseClient #10336
  • Add postProcess support to Saml2LogoutConfigurer, closes gh-10311 #10339
  • Add saml2.ValidIssuers parameter into SAML 2.0 Assertion Validators #10341
  • Add standard OAuth 2.0 error code invalid_redirect_uri #10370
  • Add Supplier JwtDecoders #10310
  • Allow Defining Custom SAML 2.0 Assertion Signature Validator #10264
  • Allow setting custom BodyExtractor to the AbstractWebClientReactiveOAuth2AccessTokenResponseClient #10269
  • AuthenticationPrincipal argument type cannot be primitive #10172
  • Check for multiple access tokens per rfc 6750 #10302
  • Deprecate Kotlin methods that have equivalents using reified types #10365
  • Fix Antora cross-references that lead to other pages. #10345
  • Fix typo in digest.adoc #10304
  • Implement reactive support for JWT as an Authorization Grant #10327
  • Implement reactive support for JWT as an Authorization Grant #10147
  • Implement reactive support for JWT Client Authentication #10146
  • Improve Method Security logging #10279
  • Introduce JwtEncoder #9208
  • JwtDecoders and NimbusJwtDecoder should use the same JWKSource #10312
  • OAuth2LoginAuthenticationProvider information loss at exception handling #10228
  • please support lazily doing issuer checks (and all other checks) on startup for oauth resource servers #9991
  • Revamp OAuth 2.0 Client reactive documentation #10373
  • Saml2WebSsoAuthenticationFilter adds authentication details #10306
  • Saml2WebSsoAuthenticationFilter ignores the authentication details #7722
  • Structure101 Build Plugin #9768
  • Use Antora #5835

🔨 Dependency Upgrades

  • Update Gradle to 7.0 #9615
  • Update Gradle to 7.2 #10338

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

Loading

5.5.3

18 Oct 21:03
@sjohnr sjohnr
5.5.3
13e7c9f
This commit was signed with the committer’s verified signature.
Verified
Learn about vigilant mode.
Compare
Choose a tag to compare
5.5.3

⭐ New Features

  • Allow defining custom SAML 2.0 Assertion Signature Validator #10317
  • Add Documentation for Static Methods Classes for mockJwt() and jwt() #10265

🪲 Bug Fixes

  • ClaimAccessor#getClaimAsMap doesn't return null as documented #10371
  • 5.5.X only works with spring-security-5.4.xsd schema (XML-based config) #10369
  • SecurityNamespaceHandler: update schema version to 5.5 #10348
  • JwtTimeStampValidator uses wrong error on token expiration #10328
  • Fix typo #10313
  • Saml2LoginConfigurer relyingPartyRegistrationRepository method does not return correct type #10257
  • ACL docs refer to nonexistent sample apps #10237
  • SAML 2.0 Login should allow loginProcessingUrl without {registrationId} when providing an AuthenticationConverter #10176

🔨 Dependency Upgrades

  • Update org.springframework.data to 2021.0.6 #10417
  • Update org.springframework to 5.3.11 #10416
  • Update org.jetbrains.kotlinx to 1.5.2 #10415
  • Update org.jetbrains.kotlin to 1.5.31 #10414
  • Update org.eclipse.jetty to 9.4.44.v20210927 #10413
  • Update io.spring.nohttp to 0.0.10 #10412
  • Update r2dbc-spi-test to 0.8.6.RELEASE #10410
  • Update reactor-netty to 1.0.12 #10409
  • Update io.projectreactor to 2020.0.12 #10408
  • Update jackson-datatype-jsr310 to 2.12.5 #10407
  • Update jackson-databind to 2.12.5 #10406
  • Update jackson-bom to 2.12.5 #10405
  • Update logback-classic to 1.2.6 #10404

❤️ Contributors

We'd like to thank all the contributors who worked on this release!

Loading