| 1234567891011121314151617181920212223242526272829303132333435363738394041424344454647 |
- [[new]]
- == What's New in Spring Security 5.1
- Spring Security 5.1 provides a number of new features.
- Below are the highlights of the release.
- === Servlet
- * https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2webclient[OAuth 2.0 Client]
- ** Customizable Authorize and Token requests
- ** `authorization_code` grant support
- ** `client_credentials` grant support
- * OAuth 2.0 Resource Server - support for https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver[JWT-encoded bearer tokens]
- * https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2webclient[OAuth 2.0 Web Client Extensions] - Supports `authorization_code`, `client_credentials`, and `refresh_token` grants
- * <<core-services-password-encoding>> - New service to support password upgrades
- * <<request-matching>> - Protection against HTTP Verb Tampering and Cross-site Tracing
- * <<exception-translation-filter>> - Support for selecting an `AccessDeniedHandler` by `RequestMatcher`
- * <<csrf>> - Support for disabling csrf by `RequestMatcher`
- * <<headers>> - Support for `Feature-Policy`
- * <<session-mgmt>> - Support for `@Transient` authentication tokens
- * A modern look-and-feel for the default log in page
- === WebFlux
- * https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2webclient-webflux[OAuth 2.0 Client]
- ** Customizable Authorize requests
- ** `authorization_code` grant support
- ** `client_credentials` grant support
- * OAuth 2.0 Resource Server - support for https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2resourceserver-webflux[JWT-encoded bearer tokens]
- * https://github.com/spring-projects/spring-security/tree/master/samples/boot/oauth2webclient-webflux[OAuth 2.0 Web Client Extensions] - Supports `authorization_code`, `client_credentials`, and `refresh_token` grants
- * <<test-method>> - `@WithUserDetails` now works with `ReactiveUserDetailsService`
- * <<cors>> - Support for CORS was added
- * <<headers>> - Support for `Content-Security-Policy`, `Feature-Policy`, and `Referrer-Policy`
- * Support for redirecting to HTTPS
- === Integrations
- * <<jackson>> - Support for `BadCredentialsException`
- * <<test-method>> - Support for customizing when the `SecurityContext` is setup in the test.
- For example, `@WithMockUser(setupBefore = TestExecutionEvent.TEST_EXECUTION)` will setup a user after JUnit's `@Before` and before the test executes.
- * <<ldap>> - Support for setting up an `LdapContext` from custom environment variables
- * <<x509>> - Support for deriving the X.509 principal via a strategy
- * <<mvc-authentication-principal>>
- ** Support for resolving beans in WebFlux (support already exists for Spring MVC)
- ** Support for resolving `errorOnInvalidType` in WebFlux (support already exists for Spring MVC)
|
