Spring Security 6: The Next Generation
summary
Step-by-step migration path to Spring Security 6: replace deprecated configuration by remove WebSecurityConfigurerAdapter, add configuration annotation, switch authorization rules to the new requestMatchers and AuthorizationManager lambda APIs, and adopt lambda DSL ahead of 6.1. Defaults change: unspecified routes are denied and CSRF tokens gain BREACH protection by XORing tokens with random bytes so tokens look different per page. Demo integrates Open Policy Agent (OPA) via REST client and an AuthorizationManager proxy, with tests proving policy checks return allow/deny as expected.
AI-written summary · about
chapters (7)
- 0:00Introduction and setup
- 2:07Migration to Spring Security 6
- 12:20New authorization manager API
- 17:34BREACH attack protection
- 21:49Custom authorization rules
- 29:11Open Policy Agent integration
- 38:06Q&A and closing
related talks
46mEverything new in Spring Security 6 baked with a Spring Boot3 recipe
51mEverything new in Spring Security 6 baked with a Spring Boot 3 recipe
45mSpring Security: The Good Parts
33mSpring Security Patterns
01h 52mSpring Security: The Good Parts
50mAuthorization in Spring Security: permissions, roles and beyond
54mSpring Security Patterns
48mModern Authentication Demystified: A Deep Dive into Spring Security’s Latest Innovations