What’s New in Spring Security 7.0

Spring Security 7.0 provides a number of new features. Below are the highlights of the release, or you can view the release notes for a detailed listing of each feature and bug fix.spring-doc.cn

Removals

Being a major release, there are a number of deprecated APIs that are removed in Spring Security 7. Each section that follows will indicate the more notable removals as well as the new features in that modulespring-doc.cn

Modules

The Spring Security Kerberos Extension is now part of Spring Security. See the Kerberos section of the reference for details.spring-doc.cn
Spring Authorization Server is now part of Spring Security. See the OAuth 2.0 Authorization Server section of the reference for details.spring-doc.cn

Core

Added Support for Multi-Factor Authentication spring-doc.cn
Removed AuthorizationManager#check in favor of AuthorizationManager#authorizespring-doc.cn
Added AllAuthoritiesAuthorizationManager and AllAuthoritiesReactiveAuthorizationManager along with corresponding methods for Authorizing HttpServletRequests and method security expressions.spring-doc.cn
Added AuthorizationManagerFactory for creating AuthorizationManager instances in request-based and method-based authorization componentsspring-doc.cn
Added Authentication.Builder for mutating and merging Authentication instancesspring-doc.cn
Moved Access API (AccessDecisionManager, AccessDecisionVoter, etc.) to a new module, spring-security-accessspring-doc.cn

Config

Support modular configuration in Servlets and WebFlux spring-doc.cn
Removed and() from the HttpSecurity DSL in favor of using the lambda methodsspring-doc.cn
Removed authorizeRequests in favor of authorizeHttpRequestsspring-doc.cn
Simplified expression migration for authorizeRequestsspring-doc.cn
Added support for SPA-based CSRF configurationspring-doc.cn
Added support for binding missing authorities to authentication mechanisms.spring-doc.cn
Java
http.csrf((csrf) -> csrf.spa());

Crypto

Added Password4j-based password encoders providing alternative implementations for popular hashing algorithms:spring-doc.cn
- Argon2Password4jPasswordEncoder - Argon2 spring-doc.cn
- BcryptPassword4jPasswordEncoder - BCrypt spring-doc.cn
- ScryptPassword4jPasswordEncoder - SCrypt spring-doc.cn
- Pbkdf2Password4jPasswordEncoder - PBKDF2 spring-doc.cn
- BalloonHashingPassword4jPasswordEncoder - Balloon Hashing spring-doc.cn

Data

Added support to Authorized objects for Spring Data typesspring-doc.cn

LDAP

Removed ApacheDsContainer and related Apache DS support in favor of UnboundIDspring-doc.cn

OAuth 2.0

Removed support for password grantspring-doc.cn
Added OAuth2 Support for HTTP Service Clients spring-doc.cn
Added support for custom JwkSource in NimbusJwtDecoder, allowing usage of Nimbus’s JwkSourceBuilder APIspring-doc.cn
Added builder for NimbusJwtEncoder, supports specifying an EC or RSA key pair or a secret keyspring-doc.cn
Added support for @ClientRegistrationId at the type level, eliminating the need for method level repetitionspring-doc.cn
Added support for OAuth 2.0 Dynamic Registration Protocol spring-doc.cn
Enabled PKCE by default in OAuth 2.0 Authorization Serverspring-doc.cn

SAML 2.0

Removed API methods based on AssertingPartyDetails class in favor of AssertingPartyMetadata interfacespring-doc.cn
Removed GET request support from Saml2AuthenticationTokenConverterspring-doc.cn
Added JDBC-based AssertingPartyMetadataRepositoryspring-doc.cn
Made so that SLO still returns <saml2:LogoutResponse> even when validation failsspring-doc.cn
Removed Open SAML 4 support; applications should migrate to Open SAML 5spring-doc.cn

Test

Add SecurityMockMvcResultMatchers.withAuthorities(String…)spring-doc.cn

Web

Removed MvcRequestMatcher and AntPathRequestMatcher in favor of PathPatternRequestMatcherspring-doc.cn
Added SubjectX500PrincipalExtractorspring-doc.cn
Added support for propagating exceptions in Authorized proxies through Spring MVC controllersspring-doc.cn
Added support to Authorized objects for Spring MVC typesspring-doc.cn
Added support to Default Login Page to show factors based on factor.type and factor.reason parametersspring-doc.cn
Changed LoginUrlAuthenticationEntryPoint to favor relative redirects by defaultspring-doc.cn