Modern Authentication Demystified: A Deep Dive into Spring Security’s Latest Innovations
summary
Spring Security 6.3–6.5 adds concrete tools: built-in compromised-password checks against the HaveIBeenPwned API, a working One-Time Token login flow with a mail-based magic link demo, and a live Passkey (WebAuthn/FIDO2) demo that registers keys, works cross-device (iPhone Face ID), and stores credentials persistently. Token exchange (OAuth Token Exchange) is implemented with spring-authorization-server and an example client manager workflow, though the present live demo failed; token binding (DPoP), JWT access-token typing, mutual TLS client-bound tokens and backend‑for‑frontend examples are provided.
AI-written summary · about
chapters (9)
- 0:00Spring Security innovations
- 1:50Password checking in Spring Security 6.3
- 6:55OAuth token exchange for microservices
- 18:41Spring Security 6.3 and 6.4 features
- 22:43Debugging filter chain errors
- 23:48One-time token login
- 28:07Passkeys authentication
- 40:18Spring Security 6.5 innovations
- 43:10Spring Security 7.0 changes
related talks
43mIdentity crisis: bending Spring Security to your advanced use-cases
01h 02mModern Authentication
01h 06mTutorial: Passkeys to the People: Building a Modern MFA Application with Open Source...
57mSpring Security for N00bz: A quick introduction for the terminally insecure
40mGoing passwordless with Web Authentication
49mA Passwordless Future! WebAuthn for Java Developers
51mA Passwordless Future! Passkeys for Java Developers
46mEverything new in Spring Security 6 baked with a Spring Boot3 recipe