This version is still in development and is not considered stable yet. For the latest stable version, please use Spring Security 6.5.2!

What’s New in Spring Security 7.0

Spring Security 7.0 provides a number of new features. Below are the highlights of the release, or you can view the release notes for a detailed listing of each feature and bug fix.

Removals

Being a major release, there are a number of deprecated APIs that are removed in Spring Security 7. Each section that follows will indicate the more notable removals as well as the new features in that module

Core

  • Removed AuthorizationManager#check in favor of AuthorizationManager#authorize

Config

  • Removed and() from the HttpSecurity DSL in favor of using the lambda methods

  • Removed authorizeRequests in favor of authorizeHttpRequests

  • Simplified expression migration for authorizeRequests

  • Added support for SPA-based CSRF configuration:

    Java
    http.csrf((csrf) -> csrf.spa());

Data

  • Added support to Authorized objects for Spring Data types

LDAP

  • Removed ApacheDsContainer and related Apache DS support in favor of UnboundID

OAuth 2.0

  • Removed support for password grant

  • Added OAuth2 Support for HTTP Interface Integration

  • Added support for custom JwkSource in NimbusJwtDecoder, allowing usage of Nimbus’s JwkSourceBuilder API

  • Added builder for NimbusJwtEncoder, supports specifying an EC or RSA key pair or a secret key

SAML 2.0

  • Removed API methods based on AssertingPartyDetails class in favor of AssertingPartyMetadata interface

  • Removed GET request support from Saml2AuthenticationTokenConverter

  • Added JDBC-based AssertingPartyMetadataRepository

  • Made so that SLO still returns <saml2:LogoutResponse> even when validation fails

Web

  • Removed MvcRequestMatcher and AntPathRequestMatcher in favor of PathPatternRequestMatcher

  • Added SubjectX500PrincipalExtractor

  • Added support for propagating exceptions in Authorized proxies through Spring MVC controllers

  • Added support to Authorized objects for Spring MVC types