New in Spring Security 7: MFA, OAuth2 and more
summary
Spring Security 7 ships a concrete MFA API: a new factor-granted-authority type, an enable-multifactor-authentication scaffold, and authorization-manager factories that let endpoints require specific factors or recency (example: password freshness durations). OAuth2 changes include PKCE enforced by default (require-proof-key can be disabled), dynamic client registration with a client.create scope and one-time registration tokens, and HTTP service client support requiring a client-registration-id plus the O2 REST client http service configurer. Modular config uses HttpSecurity and per-configurer customizers instead of replacing Boot defaults.
AI-written summary · about
chapters (10)
- 0:00Introduction
- 1:29Spring Security 7 overview
- 4:41Password grant removal
- 6:28Multi-factor auth intro
- 19:47MFA deep dive
- 26:12Modular config
- 33:50OAuth2 auth server updates
- 39:53OAuth2 client improvements
- 41:15MCP security demo
- 45:30Closing remarks
related talks
48mModern Authentication Demystified: A Deep Dive into Spring Security’s Latest Innovations
46mEverything new in Spring Security 6 baked with a Spring Boot3 recipe
51mEverything new in Spring Security 6 baked with a Spring Boot 3 recipe
01h 03mNext Generation OAuth Support with Spring Security 5.0
53mNext Generation OAuth Support with Spring Security 5
51mEnterprise Security with Spring Authorization Server 1.0
40mSpring Security 6: The Next Generation
54mHow to secure your Spring apps with Keycloak