List view

Add FactorGrantedAuthority

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17996 In spring-projects/spring-security;

· by rwinch was closed on Oct 3, 2025

Authentication should use FactorGrantedAuthority

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18001 In spring-projects/spring-security;

· by rwinch was closed on Oct 3, 2025

Add AllFactorsAuthorizationManager

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17997 In spring-projects/spring-security;

· by rwinch was closed on Oct 3, 2025

DelegatingMissingAuthorityAccessDeniedHandler Should Use RequiredFactorErrors

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18002 In spring-projects/spring-security;

· by rwinch was closed on Oct 3, 2025

Providers Should Add an Authority Representing Successful Authentication

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17933 In spring-projects/spring-security;

· by jzheaux was closed on Sep 19, 2025

Security Expressions Should Allow Returning an AuthorizationManager

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17936 In spring-projects/spring-security;

· by jzheaux was closed on Sep 19, 2025

Add AccessDeniedHandler that Ties Authorities to Authentication Entry Points

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17934 In spring-projects/spring-security;

· by jzheaux was closed on Sep 25, 2025

Remove unnecessary throws Exception from spring-security-config

in: configAn issue in spring-security-configAn issue in spring-security-config

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17957 In spring-projects/spring-security;

· by joshlong was closed on Sep 25, 2025

DelegatingAuthenticationEntryPoint.Builder should not throw exception when default entry point is specified

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: bugA general bugA general bug

Status: Closed (completed).

#17955 In spring-projects/spring-security;

· by jzheaux was closed on Sep 25, 2025

Add support for OAuth 2.0 Dynamic Client Registration Protocol

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17964 In spring-projects/spring-security;

· by jgrandja was closed on Sep 25, 2025

Consider disabling device_code grant by default

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Closed (completed).

#17998 In spring-projects/spring-security;

· by jgrandja was closed on Oct 3, 2025

Support injecting clock into token generation code

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18017 In spring-projects/spring-security;

· by symposion was closed on Oct 7, 2025

Add Predicate for authorizationConsentRequired for device code grant

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18016 In spring-projects/spring-security;

· by antoinelauzon-bell was closed on Oct 7, 2025

HttpSecurity.oauth2AuthorizationServer should not automatically set <code>HttpSecurity.securityMatcher</code>

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: bugA general bugA general bug

Status: Closed (completed).

#17965 In spring-projects/spring-security;

· by rwinch was closed on Oct 1, 2025

Add <code>TestingAuthenticationToken(Object principal,Object credential,String... authorities)</code>

in: testAn issue in spring-security-testAn issue in spring-security-test

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17980 In spring-projects/spring-security;

· by rwinch was closed on Oct 1, 2025

Prevent Duplicate <code>GrantedAuthority#getAuthority()</code> at time of Authentication

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: bugA general bugA general bug

Status: Closed (completed).

#17981 In spring-projects/spring-security;

· by rwinch was closed on Oct 1, 2025

Implement OAuth 2.0 Protected Resource Metadata

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#17244 In spring-projects/spring-security;

· by jgrandja was closed on Oct 2, 2025

Enable PKCE by default in authorization server

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Closed (completed).

#18020 In spring-projects/spring-security;

· by jgrandja was closed on Oct 9, 2025

Create AuthorizationManagerFactories.multiFactor

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18032 In spring-projects/spring-security;

· by rwinch was closed on Oct 10, 2025

Add <code>RequiredFactor.Builder.&lt;factor-name&gt;Authority()</code>

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18033 In spring-projects/spring-security;

· by rwinch was closed on Oct 10, 2025

Add RequiredAuthoritiesAuthorizationManager

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18028 In spring-projects/spring-security;

· by rwinch was closed on Oct 10, 2025

Document Multi-Factor Simple to Complex

in: docsAn issue in Documentation or samplesAn issue in Documentation or samples

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18029 In spring-projects/spring-security;

· by rwinch was closed on Oct 10, 2025

Move FACTOR_ constants to FactorGrantedAuthority

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: bugA general bugA general bug

Status: Closed (completed).

#18030 In spring-projects/spring-security;

· by rwinch was closed on Oct 10, 2025

AllFactorsAuthorizationManager -&gt; AllRequiredFactorsAuthorizationManager

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Closed (completed).

#18031 In spring-projects/spring-security;

· by rwinch was closed on Oct 10, 2025

ProviderManager.copyDetails Changes Authentication to new Type

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: bugA general bugA general bug

Status: Closed (completed).

#18027 In spring-projects/spring-security;

· by rwinch was closed on Oct 10, 2025