List view

Remove SecurityContextPersistenceFilter in Favor of Explicit Saves

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#9634 In spring-projects/spring-security;

· rwinch opened on Apr 13, 2021

Remove authorizeRequests

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#11954 In spring-projects/spring-security;

· jzheaux opened on Oct 5, 2022

Restructure AuthenticationServiceException handling

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Open.

#12134 In spring-projects/spring-security;

· jzheaux opened on Nov 2, 2022

Remove shouldFilterAllDispatcherTypes

in: configAn issue in spring-security-configAn issue in spring-security-config

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#12139 In spring-projects/spring-security;

· marcusdacoregio opened on Nov 3, 2022

Remove Deprecations

type: taskA general taskA general task

Status: Open.

#13068 In spring-projects/spring-security;

· marcusdacoregio opened on Apr 18, 2023

Remove AbstractConfiguredSecurityBuilder#apply

in: configAn issue in spring-security-configAn issue in spring-security-config

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#13441 In spring-projects/spring-security;

· marcusdacoregio opened on Jun 30, 2023

Default Servlet Headers Should Include Referrer-Policy

in: configAn issue in spring-security-configAn issue in spring-security-config

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#13567 In spring-projects/spring-security;

· marcusdacoregio opened on Jul 20, 2023

Remove deprecations from CookieCsrfTokenRepository

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#14132 In spring-projects/spring-security;

· marcusdacoregio opened on Nov 13, 2023

Remove <code>authorizeRequests</code> from Kotlin DSL

in: configAn issue in spring-security-configAn issue in spring-security-config

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#15174 In spring-projects/spring-security;

· marcusdacoregio opened on May 27, 2024

Consider Signing Metadata by Default

in: saml2An issue in SAML2 modulesAn issue in SAML2 modules

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#15182 In spring-projects/spring-security;

· jzheaux opened on May 31, 2024

Should OidcIdToken implement equals?

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#15156 In spring-projects/spring-security;

· MatthiasWinzeler opened on May 24, 2024

Support UnboundID LDAP SDK 7.0

type: dependency-upgradeA dependency upgradeA dependency upgrade

Status: Open.

#14772 In spring-projects/spring-security;

· wilkinsona opened on Mar 18, 2024

Remove PortResolver

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: enhancementA general enhancementA general enhancement

Status: Open.

#15971 In spring-projects/spring-security;

· rwinch opened on Oct 22, 2024

Favor Relative Redirects by Default

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#16300 In spring-projects/spring-security;

· jzheaux opened on Dec 18, 2024

Consider Enabling PKCE for Authorization Code by Default

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open.

#16391 In spring-projects/spring-security;

· rwinch opened on Jan 9, 2025

Consider making UserInfo request opt-in instead of default in Spring Security 7

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open.

#16843 In spring-projects/spring-security;

· sjohnr opened on Mar 28, 2025

Default to XorCsrfChannelInterceptor in XML configuration

in: configAn issue in spring-security-configAn issue in spring-security-config

status: feedback-providedFeedback has been providedFeedback has been provided

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open (in progress).

spring-projects/spring-securitynumber 17323

#17323 In spring-projects/spring-security;

· msqr opened on Jun 20, 2025

Use <code>LdapName</code> instead of <code>DistinguishedName</code>

in: ldapAn issue in spring-security-ldapAn issue in spring-security-ldap

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open (in progress).

spring-projects/spring-securitynumber 17325

#17325 In spring-projects/spring-security;

· therepanic opened on Jun 21, 2025