Search results

Consider preventing role names from including the role prefix in <code>SecurityExpressionRoot</code>

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#17783 In spring-projects/spring-security;

· sjohnr opened on Aug 20, 2025

· 

7.0.x

Consider preventing null <code>defaultRolePrefix</code> in <code>SecurityExpressionRoot</code>

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#17782 In spring-projects/spring-security;

· sjohnr opened on Aug 20, 2025

· 

7.0.x

serialVersionUID values not randomly generated

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: bugA general bugA general bug

Status: Open.

#17772 In spring-projects/spring-security;

· rwinch opened on Aug 19, 2025

PKCE configuration - enabled by default

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open (in progress).

spring-projects/spring-securitynumber 17507

#17507 In spring-projects/spring-security;

· rohan-naik07 opened on Jul 10, 2025

Remove ACL access implementations in favor of <code>AclPermissionEvaluator</code>

in: aclAn issue in spring-security-aclAn issue in spring-security-acl

status: blockedAn issue that's blocked on an external project changeAn issue that's blocked on an external project change

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open (in progress).

spring-projects/spring-securitynumber 17475

#17475 In spring-projects/spring-security;

· therepanic opened on Jul 3, 2025

ServerCsrfTokenRequestHandler should return reactive types

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#16869 In spring-projects/spring-security;

· jzheaux opened on Apr 2, 2025

· 

7.0.x

Consider making UserInfo request opt-in instead of default in Spring Security 7

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open.

#16843 In spring-projects/spring-security;

· sjohnr opened on Mar 28, 2025

· 

7.0.0-M3

Consider Enabling PKCE for Authorization Code by Default

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

status: duplicateA duplicate of another issueA duplicate of another issue

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open.

#16391 In spring-projects/spring-security;

· rwinch opened on Jan 9, 2025

· 

7.0.0-M3

Favor Relative Redirects by Default

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#16300 In spring-projects/spring-security;

· jzheaux opened on Dec 18, 2024

· 

7.0.0-M3

Leave Filter Chain Observations Off By Default

in: configAn issue in spring-security-configAn issue in spring-security-config

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#15858 In spring-projects/spring-security;

· jzheaux opened on Sep 26, 2024

· 

7.0.x

Consider favoring ObjectProvider#getIfAvailable

in: configAn issue in spring-security-configAn issue in spring-security-config

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#15821 In spring-projects/spring-security;

· jzheaux opened on Sep 17, 2024

· 

7.0.x

Consider removing generics from <code>AuthorizationRequestRepository</code>

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open.

#15426 In spring-projects/spring-security;

· sjohnr opened on Jul 15, 2024

· 

7.0.x