JWK sets are the premier way to support key rotation in Spring Security's OAuth 2.0 Resource Server.However, not all Ide...

SummaryCurrently when Using ServletOAuth2AuthorizedClientExchangeFilterFunction (this might also apply to the Server im...

Describe the bugKeycloak for spring-boot adds two filters successively which results in a NPE: @Override protected...

Some documents suggest using relaystate to pass csrftoken to solve CSRF attacks. Some documents suggest using relaystate...

SummaryNot working as expected. It works only with: NoOpPasswordEncoderActual BehaviorThrows UserDetailsService is requi...

Hi,The ExceptionTranslationWebFilter doesn't check if the authentication object of the ReactiveSecurityContextHolder is ...

/cc @vpavic @jzheaux @rwinch @tnwang @nlebasLet's revisit the Authentication scheme case-insensitivity as it seems we're...

Drew Wings (Migrated from SEC-1912) said:OpenLDAP stores MD5 hashed passwords with a cipher {MD5}. When the byte array f...

Mikhail Mazursky (Migrated from SEC-1818) said:I'm using bind authenticator and i want to format userDn not only based o...

Victor Polischuk (Migrated from SEC-1894) said:There is no simple way to setup custom strategy on session invalidation. ...

christophe blin (Migrated from SEC-1872) said:The @PreAuthorize and @PostAuthorize are very handy to quickly write a sim...

Jon Osborn (Migrated from SEC-1871) said:For some implementations behind proxy services, the CookiePath must be 'url enc...

Hello.I'm using SS for Digest auth in Spring based application/Spring Core 4.2.5.Spring MVC 4.2.5.Spring Security 4.0.4....

Vladimir Korolev (Migrated from SEC-1851) said:RFC 2617 specifies that "nonce" should be uniquely generated. See http://...

Eugen Paraschiv (Migrated from SEC-1860) said:The element of the security namespace has to support basic authenticatio...

Describe the bugWhen given a valid URL such as ldap://server/dc=org%20with%20space,dc=com, the DefaultSpringSecurityCon...

Michael Furman (Migrated from SEC-1844) said:Hi!It is important to add the HTTPonly flag to the rememberMe cookie.Versio...

wayne zheng (Migrated from SEC-1831) said:In the Class org.springframework.security.web.savedrequest.HttpSessionRequestC...

The Alchemist (Migrated from SEC-1840) said:org.springframework.security.core.userdetails.memory.UserMap is deprecated b...

Dave Syer (Migrated from SEC-1801) said:Please put generated POMs in samples and include with git source code. I'd real...