This version is still in development and is not considered stable yet. For the latest stable version, please use Spring Security 6.3.3!

What’s New in Spring Security 6.4

Spring Security 6.4 provides a number of new features. Below are the highlights of the release, or you can view the release notes for a detailed listing of each feature and bug fix.

Method Security

  • All method security annotations now support Framework’s @AliasFor

  • @AuthenticationPrincipal and @CurrentSecurityContext now support annotation templates.

    This means that you can now use Spring’s meta-annotation support like so:

    • Java

    • Kotlin

    @Target(TargetType.TYPE)
@Retention(RetentionPolicy.RUNTIME)
@AuthenticationPrincipal("claims['{claim}']")
@interface CurrentUsername {
	String claim() default "sub";
}

// ...

@GetMapping
public String method(@CurrentUsername("username") String username) {
	// ...
}
    annotation CurrentUsername(val claim: String = "sub")

// ...

@GetMapping
fun method(@CurrentUsername("username") val username: String): String {
	// ...
}

  • Several improvements were made to align Security’s annotation search with AbstractFallbackMethodSecurityMetadataSource's algorithm. This aids in migration from earlier versions of Spring Security.

OAuth 2.0

SAML 2.0

  • Added OpenSAML 5 Support. Now you can use either OpenSAML 4 or OpenSAML 5; by default, Spring Security will select the write implementations based on what’s on your classpath.

  • Using EntityIDs for the registrationId is simplified.

    A common pattern is to identify asserting parties by their entityID. In previous versions, this required directly configuring OpenSamlAuthenticationRequestResolver. Now, the request resolver looks by default for the registrationId as a request parameter in addition to looking for it in the path. This allows you to use RelyingPartyRegistrations or OpenSaml4/5AssertingPartyMetadataRepository without also needing to modify the registrationId values or customize the request resolver.

    Relatedly, you can now configure your authenticationRequestUri to contain a query parameter

  • Asserting Parties can now be refreshed in the background according to the metadata’s expiry.

    For example, you can now use OpenSaml5AssertingPartyMetadataRepository to do:

    • Java

    • Kotlin

    @Component
public class RefreshableRelyingPartyRegistrationRepository implements IterableRelyingPartyRegistrationRepository {
	private final AssertingPartyMetadataRepository assertingParties = OpenSaml5AssertingPartyMetadataRepository
		.fromTrustedMetadataLocation("https://idp.example.org").build();

	@Override
	public RelyingPartyRegistration findByRegistrationId(String registrationId) {
		AssertingPartyMetadata assertingParty = this.assertingParties.findByEntityId(registrationId);
		return RelyingPartyRegistration.withAssertingPartyMetadata(assertingParty)
			// relying party configurations
			.build();
	}

	// ...
}
    @Component
open class RefreshableRelyingPartyRegistrationRepository: IterableRelyingPartyRegistrationRepository {
	private val assertingParties: AssertingPartyMetadataRepository = OpenSaml5AssertingPartyMetadataRepository
		.fromTrustedMetadataLocation("https://idp.example.org").build()

	override fun findByRegistrationId(String registrationId): RelyingPartyRegistration {
		val assertingParty = this.assertingParties.findByEntityId(registrationId)
		return RelyingPartyRegistration.withAssertingPartyMetadata(assertingParty)
			// relying party configurations
			.build()
	}

	// ...
}

    This implementation also supports the validation of a metadata’s signature.

  • You can now sign relying party metadata

  • RelyingPartyRegistrationRepository results can now be cached. This is helpful if you want to defer the loading of the registration values til after application startup. It is also helpful if you want to control when metadata gets refreshed.

  • To align with the SAML 2.0 standard, the metadata endpoint now uses the application/samlmetadata+xml MIME type

Web

  • CSRF BREACH tokens are now more consistent

  • The Remember Me cookie now is more customizable

  • Security Filter Chain is now improved. Specifically, the following arrangement is invalid since an any request filter chain comes before all other filter chains:

    • Java

    • Kotlin

    @Bean
@Order(0)
SecurityFilterChain api(HttpSecurity http) throws Exception {
    http
        .authorizeHttpRequests(...)
        .httpBasic(...)

    return http.build();
}

@Bean
@Order(1)
SecurityFilterChain app(HttpSecurity http) throws Exception {
    http
        .securityMatcher("/app/**")
        .authorizeHttpRequests(...)
        .formLogin(...)

    return http.build();
}
    @Bean
@Order(0)
fun api(val http: HttpSecurity): SecurityFilterChain {
    http {
		authorizeHttpRequests {
			// ...
		}
	}
    return http.build();
}

@Bean
@Order(1)
fun app(val http: HttpSecurity): SecurityFilterChain {
    http {
		securityMatcher("/app/**")
		authorizeHttpRequests {
			// ...
		}
	}
    return http.build();
}

    You can read more in the related ticket.

Kotlin

Acl