From 760fbc2d095414514299c51e65ef13dc129504ac Mon Sep 17 00:00:00 2001 From: Ankur Date: Sun, 25 Oct 2026 19:04:59 +0000 Subject: [PATCH] security-7-migration: add javap inspection output, link the article Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01YPgGH6aMbSLANL3E2HHmS6 --- README.md | 2 +- .../output/08-javap-encoder-and-manager.txt | 15 +++++++++++++++ security-7-migration/scripts/inspect-jars.sh | 14 ++++++++++++++ security-7-migration/scripts/run-all.sh | 1 + 4 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 security-7-migration/output/08-javap-encoder-and-manager.txt create mode 100755 security-7-migration/scripts/inspect-jars.sh diff --git a/README.md b/README.md index b24b008..acc9691 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ Runnable companion code for six articles on [ankurm.com](https://ankurm.com): | 4 | [Passkeys and WebAuthn with Spring Security 7](https://ankurm.com/passkeys-webauthn-spring-security-7/) | [`passkeys/`](passkeys) | | 5 | [Keycloak with Spring Boot 4.1: Roles, Resource Server and Admin API](https://ankurm.com/keycloak-spring-boot-4-1-roles-resource-server-admin-api/) | [`keycloak/`](keycloak) | | 6 | [Spring Security hasPermission() with PermissionEvaluator and @EnableMethodSecurity](https://ankurm.com/spring-security-haspermission-permissionevaluator-method-security/) | [`permission-evaluator/`](permission-evaluator) — Spring Boot 4.1.2 / Security 7.1.2 | -| 7 | Spring Security 6 to 7 migration guide (post pending) | [`security-7-migration/`](security-7-migration) — Security 6.5.11 vs 7.1.2 | +| 7 | [Spring Security 6 to 7 Migration Guide: Removed APIs, Moved Modules and What Breaks](https://ankurm.com/spring-security-6-to-7-migration-guide/) | [`security-7-migration/`](security-7-migration) — Security 6.5.11 vs 7.1.2 | Five Maven projects. The first four share one [`docs/`](docs) tree; `keycloak/` keeps its explanations in the article. The first mints and verifies its own tokens with a hand-written filter. The second verifies tokens minted by somebody else — diff --git a/security-7-migration/output/08-javap-encoder-and-manager.txt b/security-7-migration/output/08-javap-encoder-and-manager.txt new file mode 100644 index 0000000..ba4e5af --- /dev/null +++ b/security-7-migration/output/08-javap-encoder-and-manager.txt @@ -0,0 +1,15 @@ +== Spring Security 6.5.11: BCryptPasswordEncoder + public java.lang.String encode(java.lang.CharSequence); + public boolean matches(java.lang.CharSequence, java.lang.String); + public boolean upgradeEncoding(java.lang.String); +== Spring Security 6.5.11: AuthorizationManager + public abstract authorization.AuthorizationDecision check(java.util.function.Supplier, T); + public default authorization.AuthorizationResult authorize(java.util.function.Supplier, T); + +== Spring Security 7.1.2: BCryptPasswordEncoder + protected java.lang.String encodeNonNullPassword(java.lang.String); + protected boolean matchesNonNull(java.lang.String, java.lang.String); + protected boolean upgradeEncodingNonNull(java.lang.String); +== Spring Security 7.1.2: AuthorizationManager + public abstract authorization.AuthorizationResult authorize(java.util.function.Supplier, T); + diff --git a/security-7-migration/scripts/inspect-jars.sh b/security-7-migration/scripts/inspect-jars.sh new file mode 100755 index 0000000..37e0492 --- /dev/null +++ b/security-7-migration/scripts/inspect-jars.sh @@ -0,0 +1,14 @@ +#!/usr/bin/env bash +# Shows two signatures that api_diff.py reports as "removed", straight from javap, so the report can be read correctly. +set -u +cd "$(dirname "$0")/.." +J=target/jars +{ + for v in 6.5.11 7.1.2; do + echo "== Spring Security $v: BCryptPasswordEncoder" + javap -protected -cp $J/spring-security-crypto-$v.jar org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder 2>/dev/null | grep -E "encode|matches|upgradeEncoding" + echo "== Spring Security $v: AuthorizationManager" + javap -protected -cp $J/spring-security-core-$v.jar org.springframework.security.authorization.AuthorizationManager 2>/dev/null | grep -E "check|authorize" + echo + done +} | sed 's/org\.springframework\.security\.//g' > output/08-javap-encoder-and-manager.txt diff --git a/security-7-migration/scripts/run-all.sh b/security-7-migration/scripts/run-all.sh index d20f657..9892414 100755 --- a/security-7-migration/scripts/run-all.sh +++ b/security-7-migration/scripts/run-all.sh @@ -5,3 +5,4 @@ cd "$(dirname "$0")/.." python3 scripts/api_diff.py ./scripts/compile-old-apis.sh ./scripts/run-probes.sh +./scripts/inspect-jars.sh