List view

PKCE configuration - enabled by default

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Draft (not ready).

spring-projects/spring-securitynumber 17507

#17507 In spring-projects/spring-security;

· rohan-naik07 opened on Jul 10, 2025

Restructure AuthenticationServiceException handling

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Open.

#12134 In spring-projects/spring-security;

· jzheaux opened on Nov 2, 2022

Remove Deprecations

type: taskA general taskA general task

Status: Open.

#13068 In spring-projects/spring-security;

· marcusdacoregio opened on Apr 18, 2023

Default Servlet Headers Should Include Referrer-Policy

in: configAn issue in spring-security-configAn issue in spring-security-config

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#13567 In spring-projects/spring-security;

· marcusdacoregio opened on Jul 20, 2023

Consider Signing Metadata by Default

in: saml2An issue in SAML2 modulesAn issue in SAML2 modules

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#15182 In spring-projects/spring-security;

· jzheaux opened on May 31, 2024

Favor Relative Redirects by Default

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#16300 In spring-projects/spring-security;

· jzheaux opened on Dec 18, 2024

Add TimestampedGrantedAuthority for time-based authorization

in: coreAn issue in spring-security-coreAn issue in spring-security-core

type: enhancementA general enhancementA general enhancement

Status: Open (in progress).

spring-projects/spring-securitynumber 17867

#17867 In spring-projects/spring-security;

· yybmion opened on Sep 10, 2025

Remove SecurityContextPersistenceFilter in Favor of Explicit Saves

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#9634 In spring-projects/spring-security;

· rwinch opened on Apr 13, 2021

Should OidcIdToken implement equals?

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

type: enhancementA general enhancementA general enhancement

Status: Open.

#15156 In spring-projects/spring-security;

· MatthiasWinzeler opened on May 24, 2024

Consider Enabling PKCE for Authorization Code by Default

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

status: duplicateA duplicate of another issueA duplicate of another issue

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open.

#16391 In spring-projects/spring-security;

· rwinch opened on Jan 9, 2025

Consider making UserInfo request opt-in instead of default in Spring Security 7

in: oauth2An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)An issue in OAuth2 modules (oauth2-core, oauth2-client, oauth2-resource-server, oauth2-jose)

type: breaks-passivityA change that breaks passivity with the previous releaseA change that breaks passivity with the previous release

Status: Open.

#16843 In spring-projects/spring-security;

· sjohnr opened on Mar 28, 2025

Add AccessDeniedHandler that Ties Authorities to Authentication Entry Points

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: enhancementA general enhancementA general enhancement

Status: Open.

#17934 In spring-projects/spring-security;

· jzheaux opened on Sep 18, 2025

Default Login Page Should Pre-populate Username Field If Already Logged In

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: enhancementA general enhancementA general enhancement

Status: Open.

#17935 In spring-projects/spring-security;

· jzheaux opened on Sep 18, 2025

Add Multi-factor Authentication Support

in: webAn issue in web modules (web, webmvc)An issue in web modules (web, webmvc)

type: enhancementA general enhancementA general enhancement

Status: Draft (not ready).

spring-projects/spring-securitynumber 17775

#17775 In spring-projects/spring-security;

· jzheaux opened on Aug 19, 2025