| 123456789101112131415161718192021222324252627282930313233343536373839404142434445464748 |
- [[new]]
- == What's New in Spring Security 5.1
- Spring Security 5.1 provides a number of new features.
- Below are the highlights of the release.
- === Servlet
- * {gh-samples-url}/boot/oauth2webclient[OAuth 2.0 Client]
- ** Customizable Authorize and Token requests
- ** `authorization_code` grant support
- ** `client_credentials` grant support
- * OAuth 2.0 Resource Server - support for {gh-samples-url}/boot/oauth2resourceserver[JWT-encoded bearer tokens]
- * {gh-samples-url}/boot/oauth2webclient[OAuth 2.0 Web Client Extensions] - Supports `authorization_code`, `client_credentials`, and `refresh_token` grants
- * <<request-matching>> - Protection against HTTP Verb Tampering and Cross-site Tracing
- * <<exception-translation-filter>> - Support for selecting an `AccessDeniedHandler` by `RequestMatcher`
- * <<csrf>> - Support for disabling csrf by `RequestMatcher`
- * <<headers-feature>>
- * <<session-mgmt>> - Support for `@Transient` authentication tokens
- * A modern look-and-feel for the default log in page
- === WebFlux
- * Added <<webflux-oauth2,OAuth2>> support
- ** Added <<webflux-oauth2-client,OAuth2 Client>> support
- ** Added<<webflux-oauth2-resource-server,OAuth2 Resource Server>> support
- ** Added OAuth2 <<webclient,WebClient>> integration
- * <<test-method>> - `@WithUserDetails` now works with `ReactiveUserDetailsService`
- * <<cors>> - Support for CORS was added
- * Added support for the following <<webflux-headers,HTTP headers>>
- ** <<webflux-headers-csp,Content Security Policy>>
- ** <<webflux-headers-feature,Feature Policy>>
- ** <<webflux-headers-referrer,Referrer Policy>>
- * Support for redirecting to HTTPS
- === Integrations
- * <<core-services-password-encoding>> - New service to support password upgrades
- * <<jackson>> - Support for `BadCredentialsException`
- * <<test-method>> - Support for customizing when the `SecurityContext` is setup in the test.
- For example, `@WithMockUser(setupBefore = TestExecutionEvent.TEST_EXECUTION)` will setup a user after JUnit's `@Before` and before the test executes.
- * <<ldap>> - Support for setting up an `LdapContext` from custom environment variables
- * <<x509>> - Support for deriving the X.509 principal via a strategy
- * <<mvc-authentication-principal>>
- ** Support for resolving beans in WebFlux (support already exists for Spring MVC)
- ** Support for resolving `errorOnInvalidType` in WebFlux (support already exists for Spring MVC)
|
