2. What’s New in Spring Security 5.1
Spring Security 5.1 provides a number of new features. Below are the highlights of the release.
- Automatic password storage upgrades through UserDetailsPasswordService
-
- Customizable Authorize and Token requests
authorization_codegrant supportclient_credentialsgrant support
- OAuth 2.0 Resource Server - support for JWT-encoded bearer tokens
- Added OAuth2 WebClient integration
- HTTP Firewall protects against HTTP Verb Tampering and Cross-site Tracing
- ExceptionTranslationFilter support for selecting an
AccessDeniedHandlerbyRequestMatcher - CSRF support for excluding certain requests
- Added Support for Feature Policy
- Added @Transient authentication tokens
- A modern look-and-feel for the default log in page
- Automatic password storage upgrades through ReactiveUserDetailsPasswordService
Added OAuth2 support
- Added OAuth2 Client support
- Added OAuth2 Resource Server support
- Added OAuth2 WebClient integration
@WithUserDetailsnow works withReactiveUserDetailsService- Added CORS support
Added support for the following HTTP headers
- Redirect to HTTPS
Improvements for @AuthenticationPrincipal
- Support for resolving beans
- Support for resolving
errorOnInvalidType
- Jackson Support works with
BadCredentialsException @WithMockUsersupports customizing when theSecurityContextis setup in the test. For example,@WithMockUser(setupBefore = TestExecutionEvent.TEST_EXECUTION)will setup a user after JUnit’s@Beforeand before the test executes.- LDAP Authentication can be configured with custom environment variables
- X.509 Authentication supports deriving the principal as a strategy