whats-new.adoc 2.4 KB

1234567891011121314151617181920212223242526272829303132333435363738394041424344454647484950515253545556575859
  1. [[new]]
  2. = What's New in Spring Security 7.0
  3. Spring Security 7.0 provides a number of new features.
  4. Below are the highlights of the release, or you can view https://github.com/spring-projects/spring-security/releases[the release notes] for a detailed listing of each feature and bug fix.
  5. == Removals
  6. Being a major release, there are a number of deprecated APIs that are removed in Spring Security 7.
  7. Each section that follows will indicate the more notable removals as well as the new features in that module
  8. == Core
  9. * Removed `AuthorizationManager#check` in favor of `AuthorizationManager#authorize`
  10. == Config
  11. * Support modular configuration in xref::servlet/configuration/java.adoc#modular-httpsecurity-configuration[Servlets] and xref::reactive/configuration/webflux.adoc#modular-serverhttpsecurity-configuration[WebFlux]
  12. * Removed `and()` from the `HttpSecurity` DSL in favor of using the lambda methods
  13. * Removed `authorizeRequests` in favor of `authorizeHttpRequests`
  14. * Simplified expression migration for `authorizeRequests`
  15. * Added support for SPA-based CSRF configuration:
  16. Java::
  17. +
  18. [source,java,role="primary"]
  19. ----
  20. http.csrf((csrf) -> csrf.spa());
  21. ----
  22. == Data
  23. * Added support to Authorized objects for Spring Data types
  24. == LDAP
  25. * Removed `ApacheDsContainer` and related Apache DS support in favor of UnboundID
  26. == OAuth 2.0
  27. * Removed support for password grant
  28. * Added OAuth2 Support for xref:features/integrations/rest/http-interface.adoc[HTTP Interface Integration]
  29. * Added support for custom `JwkSource` in `NimbusJwtDecoder`, allowing usage of Nimbus's `JwkSourceBuilder` API
  30. * Added builder for `NimbusJwtEncoder`, supports specifying an EC or RSA key pair or a secret key
  31. == SAML 2.0
  32. * Removed API methods based on `AssertingPartyDetails` class in favor of `AssertingPartyMetadata` interface
  33. * Removed GET request support from `Saml2AuthenticationTokenConverter`
  34. * Added JDBC-based `AssertingPartyMetadataRepository`
  35. * Made so that SLO still returns `<saml2:LogoutResponse>` even when validation fails
  36. * Removed Open SAML 4 support; applications should migrate to Open SAML 5
  37. == Web
  38. * Removed `MvcRequestMatcher` and `AntPathRequestMatcher` in favor of `PathPatternRequestMatcher`
  39. * Added javadoc:org.springframework.security.web.authentication.preauth.x509.SubjectX500PrincipalExtractor[]
  40. * Added support for propagating exceptions in Authorized proxies through Spring MVC controllers
  41. * Added support to Authorized objects for Spring MVC types