From e47787ecaa2da2ab8fb8ae0c88f53f9c03dcd7ac Mon Sep 17 00:00:00 2001 From: Ankur Date: Sun, 25 Oct 2026 19:00:27 +0000 Subject: [PATCH] Add security-7-migration module: Spring Security 6.5.11 vs 7.1.2 jar diff, compile checks and runtime probes Co-Authored-By: Claude Sonnet 5.5 Claude-Session: https://claude.ai/code/session_01YPgGH6aMbSLANL3E2HHmS6 --- README.md | 1 + security-7-migration/README.md | 17 + .../output/01-versions-and-baseline.txt | 10 + .../output/02-removed-api.txt | 704 ++++++++++++++++++ .../output/03-matchers-6.5.11.txt | 46 ++ .../output/03-matchers-7.1.2.txt | 47 ++ .../04-global-method-security-6.5.11.txt | 2 + ...obal-method-security-7.1.2-with-access.txt | 2 + .../04-global-method-security-7.1.2.txt | 2 + .../output/05-old-apis-6.5.11.txt | 39 + .../output/05-old-apis-7.1.2.txt | 50 ++ .../output/06-fixed-apis-6.5.11.txt | 2 + .../output/06-fixed-apis-7.1.2.txt | 2 + .../output/07-new-manager-6.5.11.txt | 9 + .../output/07-new-manager-7.1.2.txt | 2 + security-7-migration/pom.xml | 85 +++ security-7-migration/scripts/api_diff.py | 176 +++++ .../scripts/compile-old-apis.sh | 18 + security-7-migration/scripts/run-all.sh | 7 + security-7-migration/scripts/run-probes.sh | 20 + .../src/compat/NewManager.java | 15 + .../src/compat/NewSecurity.java | 27 + .../src/compat/OldSecurity.java | 47 ++ .../src/probe/MatcherProbe.java | 51 ++ .../src/probe/MethodSecurityProbe.java | 47 ++ 25 files changed, 1428 insertions(+) create mode 100644 security-7-migration/README.md create mode 100644 security-7-migration/output/01-versions-and-baseline.txt create mode 100644 security-7-migration/output/02-removed-api.txt create mode 100644 security-7-migration/output/03-matchers-6.5.11.txt create mode 100644 security-7-migration/output/03-matchers-7.1.2.txt create mode 100644 security-7-migration/output/04-global-method-security-6.5.11.txt create mode 100644 security-7-migration/output/04-global-method-security-7.1.2-with-access.txt create mode 100644 security-7-migration/output/04-global-method-security-7.1.2.txt create mode 100644 security-7-migration/output/05-old-apis-6.5.11.txt create mode 100644 security-7-migration/output/05-old-apis-7.1.2.txt create mode 100644 security-7-migration/output/06-fixed-apis-6.5.11.txt create mode 100644 security-7-migration/output/06-fixed-apis-7.1.2.txt create mode 100644 security-7-migration/output/07-new-manager-6.5.11.txt create mode 100644 security-7-migration/output/07-new-manager-7.1.2.txt create mode 100644 security-7-migration/pom.xml create mode 100644 security-7-migration/scripts/api_diff.py create mode 100755 security-7-migration/scripts/compile-old-apis.sh create mode 100755 security-7-migration/scripts/run-all.sh create mode 100755 security-7-migration/scripts/run-probes.sh create mode 100644 security-7-migration/src/compat/NewManager.java create mode 100644 security-7-migration/src/compat/NewSecurity.java create mode 100644 security-7-migration/src/compat/OldSecurity.java create mode 100644 security-7-migration/src/probe/MatcherProbe.java create mode 100644 security-7-migration/src/probe/MethodSecurityProbe.java diff --git a/README.md b/README.md index 514f14e..b24b008 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,7 @@ Runnable companion code for six articles on [ankurm.com](https://ankurm.com): | 4 | [Passkeys and WebAuthn with Spring Security 7](https://ankurm.com/passkeys-webauthn-spring-security-7/) | [`passkeys/`](passkeys) | | 5 | [Keycloak with Spring Boot 4.1: Roles, Resource Server and Admin API](https://ankurm.com/keycloak-spring-boot-4-1-roles-resource-server-admin-api/) | [`keycloak/`](keycloak) | | 6 | [Spring Security hasPermission() with PermissionEvaluator and @EnableMethodSecurity](https://ankurm.com/spring-security-haspermission-permissionevaluator-method-security/) | [`permission-evaluator/`](permission-evaluator) — Spring Boot 4.1.2 / Security 7.1.2 | +| 7 | Spring Security 6 to 7 migration guide (post pending) | [`security-7-migration/`](security-7-migration) — Security 6.5.11 vs 7.1.2 | Five Maven projects. The first four share one [`docs/`](docs) tree; `keycloak/` keeps its explanations in the article. The first mints and verifies its own tokens with a hand-written filter. The second verifies tokens minted by somebody else — diff --git a/security-7-migration/README.md b/security-7-migration/README.md new file mode 100644 index 0000000..6a29c3b --- /dev/null +++ b/security-7-migration/README.md @@ -0,0 +1,17 @@ +# security-7-migration + +Spring Security **6.5.11** against **7.1.2**: the jars compared class by class, Security 6 code compiled against both +lines, and two small programs run on both. Companion to the migration guide on [ankurm.com](https://ankurm.com). + +| script | writes | +|---|---| +| `scripts/api_diff.py` | `output/01-versions-and-baseline.txt`, `output/02-removed-api.txt` | +| `scripts/run-probes.sh` | `output/03-matchers-*.txt`, `output/04-global-method-security-*.txt` | +| `scripts/compile-old-apis.sh` | `output/05-old-apis-*.txt`, `output/06-fixed-apis-*.txt`, `output/07-new-manager-*.txt` | +| `scripts/run-all.sh` | all of the above | + +Needs JDK 17 or newer (built with 25), Maven 3.9, Python 3 and access to Maven Central. The `security6` and `security7` +Maven profiles pick Boot 3.5.16 + Security 6.5.11 or Boot 4.1.2 + Security 7.1.2. + +`02-removed-api.txt` lists exact signatures that disappeared (generics and `throws` clauses are ignored). It is a list to +check, not a list of deletions: a method that moved to a superclass shows up as removed from the subclass. diff --git a/security-7-migration/output/01-versions-and-baseline.txt b/security-7-migration/output/01-versions-and-baseline.txt new file mode 100644 index 0000000..a52f523 --- /dev/null +++ b/security-7-migration/output/01-versions-and-baseline.txt @@ -0,0 +1,10 @@ +artifact 6.x jar 7.x jar +spring-security-core 6.5.11 (Java 17) 7.1.2 (Java 17) +spring-security-config 6.5.11 (Java 17) 7.1.2 (Java 17) +spring-security-web 6.5.11 (Java 17) 7.1.2 (Java 17) +spring-security-crypto 6.5.11 (Java 17) 7.1.2 (Java 17) +spring-security-oauth2-core 6.5.11 (Java 17) 7.1.2 (Java 17) +spring-security-oauth2-client 6.5.11 (Java 17) 7.1.2 (Java 17) +spring-security-oauth2-resource-server 6.5.11 (Java 17) 7.1.2 (Java 17) +spring-security-oauth2-jose 6.5.11 (Java 17) 7.1.2 (Java 17) +spring-security-test 6.5.11 (Java 17) 7.1.2 (Java 17) diff --git a/security-7-migration/output/02-removed-api.txt b/security-7-migration/output/02-removed-api.txt new file mode 100644 index 0000000..8172a05 --- /dev/null +++ b/security-7-migration/output/02-removed-api.txt @@ -0,0 +1,704 @@ +== spring-security-core: public classes removed: 59, members removed from classes that remain: 50, new classes: 104 + class org.springframework.security.access.AccessDecisionManager [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.AccessDecisionVoter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.AfterInvocationProvider [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.ConfigAttribute [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.SecurityConfig [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.SecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.annotation.AnnotationMetadataExtractor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.annotation.Jsr250MethodSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.annotation.Jsr250SecurityConfig [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.annotation.Jsr250Voter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.annotation.SecuredAnnotationSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.event.AbstractAuthorizationEvent [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.event.AuthenticationCredentialsNotFoundEvent [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.event.AuthorizationFailureEvent [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.event.AuthorizedEvent [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.event.LoggerListener [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.event.PublicInvocationEvent [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.expression.method.ExpressionBasedAnnotationAttributeFactory [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.expression.method.ExpressionBasedPostInvocationAdvice [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.expression.method.ExpressionBasedPreInvocationAdvice [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.AbstractSecurityInterceptor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.AfterInvocationManager [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.AfterInvocationProviderManager [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.InterceptorStatusToken [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.MethodInvocationPrivilegeEvaluator [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.RunAsImplAuthenticationProvider [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.RunAsManager [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.RunAsManagerImpl [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.RunAsUserToken [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.aspectj.AspectJCallback [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.intercept.aspectj.MethodInvocationAdapter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.method.AbstractFallbackMethodSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.method.AbstractMethodSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.method.DelegatingMethodSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.method.MapBasedMethodSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.method.MethodSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.method.P [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PostInvocationAdviceProvider [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PostInvocationAttribute [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PostInvocationAuthorizationAdvice [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PreInvocationAttribute [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PreInvocationAuthorizationAdvice [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PrePostAdviceReactiveMethodInterceptor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PrePostAnnotationSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.prepost.PrePostInvocationAttributeFactory [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.vote.AbstractAccessDecisionManager [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.vote.AbstractAclVoter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.vote.AffirmativeBased [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.vote.AuthenticatedVoter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.vote.ConsensusBased [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.vote.RoleHierarchyVoter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.vote.RoleVoter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.access.vote.UnanimousBased [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.authorization.method.ExpressionAttributeAuthorizationDecision [deprecated in 6.5; gone] + class org.springframework.security.authorization.method.PrePostTemplateDefaults [deprecated in 6.5; gone] + member org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl: public org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl() [deprecated in 6.5] + member org.springframework.security.access.hierarchicalroles.RoleHierarchyImpl: public void setHierarchy(java.lang.String) [deprecated in 6.5] + member org.springframework.security.authentication.dao.DaoAuthenticationProvider: public org.springframework.security.authentication.dao.DaoAuthenticationProvider() [deprecated in 6.5] + member org.springframework.security.authentication.dao.DaoAuthenticationProvider: public org.springframework.security.authentication.dao.DaoAuthenticationProvider(org.springframework.security.crypto.password.PasswordEncoder) [deprecated in 6.5] + member org.springframework.security.authentication.dao.DaoAuthenticationProvider: public void setUserDetailsService(org.springframework.security.core.userdetails.UserDetailsService) [deprecated in 6.5] + member org.springframework.security.authorization.AuthenticatedAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, T) [NOT deprecated in 6.5] + member org.springframework.security.authorization.AuthenticatedReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, T) [NOT deprecated in 6.5] + member org.springframework.security.authorization.AuthoritiesAuthorizationManager: public org.springframework.security.authorization.AuthorityAuthorizationDecision check(java.util.function.Supplier, java.util.Collection) [NOT deprecated in 6.5] + member org.springframework.security.authorization.AuthoritiesAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.AuthorityAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, T) [deprecated in 6.5] + member org.springframework.security.authorization.AuthorityReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, T) [NOT deprecated in 6.5] + member org.springframework.security.authorization.AuthorizationEventPublisher: public abstract void publishAuthorizationEvent(java.util.function.Supplier, T, org.springframework.security.authorization.AuthorizationDecision) [deprecated in 6.5] + member org.springframework.security.authorization.AuthorizationEventPublisher: public default void publishAuthorizationEvent(java.util.function.Supplier, T, org.springframework.security.authorization.AuthorizationResult) [NOT deprecated in 6.5] + member org.springframework.security.authorization.AuthorizationManager: public abstract org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, T) [deprecated in 6.5] + member org.springframework.security.authorization.AuthorizationManager: public default org.springframework.security.authorization.AuthorizationResult authorize(java.util.function.Supplier, T) [NOT deprecated in 6.5] + member org.springframework.security.authorization.AuthorizationObservationContext: public org.springframework.security.authorization.AuthorizationDecision getDecision() [deprecated in 6.5] + member org.springframework.security.authorization.AuthorizationObservationContext: public void setDecision(org.springframework.security.authorization.AuthorizationDecision) [deprecated in 6.5] + member org.springframework.security.authorization.AuthorizationProxyFactory: public abstract java.lang.Object proxy(java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.ObservationAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, T) [deprecated in 6.5] + member org.springframework.security.authorization.ObservationReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, T) [deprecated in 6.5] + member org.springframework.security.authorization.ReactiveAuthorizationManager: public abstract reactor.core.publisher.Mono check(reactor.core.publisher.Mono, T) [deprecated in 6.5] + member org.springframework.security.authorization.ReactiveAuthorizationManager: public default reactor.core.publisher.Mono authorize(reactor.core.publisher.Mono, T) [NOT deprecated in 6.5] + member org.springframework.security.authorization.SingleResultAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, C) [NOT deprecated in 6.5] + member org.springframework.security.authorization.SpringAuthorizationEventPublisher: public void publishAuthorizationEvent(java.util.function.Supplier, T, org.springframework.security.authorization.AuthorizationDecision) [NOT deprecated in 6.5] + member org.springframework.security.authorization.event.AuthorizationDeniedEvent: public org.springframework.security.authorization.event.AuthorizationDeniedEvent(java.util.function.Supplier, T, org.springframework.security.authorization.AuthorizationDecision) [deprecated in 6.5] + member org.springframework.security.authorization.event.AuthorizationEvent: public org.springframework.security.authorization.AuthorizationDecision getAuthorizationDecision() [deprecated in 6.5] + member org.springframework.security.authorization.event.AuthorizationGrantedEvent: public org.springframework.security.authorization.event.AuthorizationGrantedEvent(java.util.function.Supplier, T, org.springframework.security.authorization.AuthorizationDecision) [deprecated in 6.5] + member org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory: public java.lang.Object proxy(java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.Jsr250AuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, org.aopalliance.intercept.MethodInvocation) [deprecated in 6.5] + member org.springframework.security.authorization.method.Jsr250AuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.MethodExpressionAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, org.aopalliance.intercept.MethodInvocation) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.MethodExpressionAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PostAuthorizeAuthorizationManager: public void setTemplateDefaults(org.springframework.security.authorization.method.PrePostTemplateDefaults) [deprecated in 6.5] + member org.springframework.security.authorization.method.PostAuthorizeAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, org.springframework.security.authorization.method.MethodInvocationResult) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PostAuthorizeAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PostAuthorizeReactiveAuthorizationManager: public void setTemplateDefaults(org.springframework.security.authorization.method.PrePostTemplateDefaults) [deprecated in 6.5] + member org.springframework.security.authorization.method.PostAuthorizeReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, org.springframework.security.authorization.method.MethodInvocationResult) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PostAuthorizeReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PostFilterAuthorizationMethodInterceptor: public void setTemplateDefaults(org.springframework.security.authorization.method.PrePostTemplateDefaults) [deprecated in 6.5] + member org.springframework.security.authorization.method.PostFilterAuthorizationReactiveMethodInterceptor: public void setTemplateDefaults(org.springframework.security.authorization.method.PrePostTemplateDefaults) [deprecated in 6.5] + member org.springframework.security.authorization.method.PreAuthorizeAuthorizationManager: public void setTemplateDefaults(org.springframework.security.authorization.method.PrePostTemplateDefaults) [deprecated in 6.5] + member org.springframework.security.authorization.method.PreAuthorizeAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, org.aopalliance.intercept.MethodInvocation) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PreAuthorizeAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PreAuthorizeReactiveAuthorizationManager: public void setTemplateDefaults(org.springframework.security.authorization.method.PrePostTemplateDefaults) [deprecated in 6.5] + member org.springframework.security.authorization.method.PreAuthorizeReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, org.aopalliance.intercept.MethodInvocation) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PreAuthorizeReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.authorization.method.PreFilterAuthorizationMethodInterceptor: public void setTemplateDefaults(org.springframework.security.authorization.method.PrePostTemplateDefaults) [deprecated in 6.5] + member org.springframework.security.authorization.method.PreFilterAuthorizationReactiveMethodInterceptor: public void setTemplateDefaults(org.springframework.security.authorization.method.PrePostTemplateDefaults) [deprecated in 6.5] + member org.springframework.security.authorization.method.SecuredAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, org.aopalliance.intercept.MethodInvocation) [deprecated in 6.5] + member org.springframework.security.authorization.method.SecuredAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] +== spring-security-config: public classes removed: 19, members removed from classes that remain: 355, new classes: 53 + class org.springframework.security.config.annotation.ObjectPostProcessor [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl$get$1$WhenMappings [NOT deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.AuthorizeRequestsDsl [NOT deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.AuthorizeRequestsDsl$get$1$WhenMappings [NOT deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.RequestMatcherFactory [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.RequiresChannelDsl$get$1$WhenMappings [NOT deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.configurers.AbstractInterceptUrlConfigurer$AbstractInterceptUrlRegistry [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer$AuthorizedUrl [NOT deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer$ExpressionInterceptUrlRegistry [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer$AuthorizedUrl [NOT deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.configurers.UrlAuthorizationConfigurer$StandardInterceptUrlRegistry [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.messaging.MessageSecurityMetadataSourceRegistry [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.messaging.MessageSecurityMetadataSourceRegistry$Constraint [NOT deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.servlet.configuration.EnableWebMvcSecurity [deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.session.SessionFixationDsl$get$1$WhenMappings [NOT deprecated in 6.5; gone] + class org.springframework.security.config.annotation.web.socket.AbstractSecurityWebSocketMessageBrokerConfigurer [deprecated in 6.5; gone] + member org.springframework.security.config.BeanIds: public static final java.lang.String EMBEDDED_APACHE_DS [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder: protected org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder: protected org.springframework.security.config.annotation.AbstractConfiguredSecurityBuilder(org.springframework.security.config.annotation.ObjectPostProcessor, boolean) [deprecated in 6.5] + member org.springframework.security.config.annotation.SecurityConfigurerAdapter: public B and() [deprecated in 6.5] + member org.springframework.security.config.annotation.SecurityConfigurerAdapter: public void addObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder: public org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer: public org.springframework.security.config.annotation.authentication.configurers.ldap.LdapAuthenticationProviderConfigurer withObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.authentication.configurers.userdetails.AbstractDaoAuthenticationConfigurer: public C withObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration: public void setObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.rsocket.RSocketSecurity$BasicAuthenticationSpec: protected org.springframework.security.rsocket.authentication.AuthenticationPayloadInterceptor build() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.rsocket.RSocketSecurity$JwtSpec: protected java.util.List build() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.rsocket.RSocketSecurity$SimpleAuthenticationSpec: protected org.springframework.security.rsocket.authentication.AuthenticationPayloadInterceptor build() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.AbstractRequestMatcherRegistry: protected final java.util.List createMvcMatchers(org.springframework.http.HttpMethod, java.lang.String...) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.AnonymousDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.AnonymousDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.AnonymousDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl: public final java.lang.Boolean getShouldFilterAllDispatcherTypes() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl: public final void setShouldFilterAllDispatcherTypes(java.lang.Boolean) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl: public static void getShouldFilterAllDispatcherTypes$annotations() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl: public final kotlin.jvm.functions.Function1.AuthorizationManagerRequestMatcherRegistry, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl: public org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl: public static final java.util.List access$getAuthorizationRules$p(org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl: public static final java.lang.String access$getHANDLER_MAPPING_INTROSPECTOR_BEAN_NAME$p(org.springframework.security.config.annotation.web.AuthorizeHttpRequestsDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.CorsDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.CorsDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.CorsDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.CsrfDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.CsrfDsl: public static final org.springframework.security.web.util.matcher.RequestMatcher[] access$getIgnoringRequestMatchers$p(org.springframework.security.config.annotation.web.CsrfDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.CsrfDsl: public static final java.lang.String[] access$getIgnoringRequestMatchersPatterns$p(org.springframework.security.config.annotation.web.CsrfDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.CsrfDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.CsrfDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.ExceptionHandlingDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.ExceptionHandlingDsl: public static final java.util.LinkedHashMap access$getDefaultDeniedHandlerMappings$p(org.springframework.security.config.annotation.web.ExceptionHandlingDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.ExceptionHandlingDsl: public static final java.util.LinkedHashMap access$getDefaultEntryPointMappings$p(org.springframework.security.config.annotation.web.ExceptionHandlingDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.ExceptionHandlingDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.ExceptionHandlingDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.FormLoginDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.FormLoginDsl: public static final kotlin.Pair access$getDefaultSuccessUrlOption$p(org.springframework.security.config.annotation.web.FormLoginDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.FormLoginDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.FormLoginDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getContentTypeOptions$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getXssProtection$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getCacheControl$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getHsts$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getFrameOptions$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getHpkp$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getContentSecurityPolicy$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getReferrerPolicy$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final java.lang.String access$getFeaturePolicyDirectives$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getPermissionsPolicy$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getCrossOriginOpenerPolicy$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getCrossOriginEmbedderPolicy$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final kotlin.jvm.functions.Function1 access$getCrossOriginResourcePolicy$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final java.util.List access$getHeaderWriters$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HeadersDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.HeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HttpBasicDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HttpBasicDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.HttpBasicDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HttpSecurityDsl: public final void authorizeRequests(kotlin.jvm.functions.Function1) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.HttpSecurityDsl: public final void build$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.HttpsRedirectDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.LogoutDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.LogoutDsl: public static final java.lang.String[] access$getDeleteCookies$p(org.springframework.security.config.annotation.web.LogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.LogoutDsl: public static final java.util.LinkedHashMap access$getDefaultLogoutSuccessHandlerMappings$p(org.springframework.security.config.annotation.web.LogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.LogoutDsl: public static final java.util.List access$getLogoutHandlers$p(org.springframework.security.config.annotation.web.LogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.LogoutDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.LogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2ClientDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2ClientDsl: public static final kotlin.jvm.functions.Function1 access$getAuthorizationCodeGrant$p(org.springframework.security.config.annotation.web.OAuth2ClientDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2LoginDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2LoginDsl: public static final kotlin.Pair access$getDefaultSuccessUrlOption$p(org.springframework.security.config.annotation.web.OAuth2LoginDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2LoginDsl: public static final kotlin.jvm.functions.Function1 access$getAuthorizationEndpoint$p(org.springframework.security.config.annotation.web.OAuth2LoginDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2LoginDsl: public static final kotlin.jvm.functions.Function1 access$getTokenEndpoint$p(org.springframework.security.config.annotation.web.OAuth2LoginDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2LoginDsl: public static final kotlin.jvm.functions.Function1 access$getRedirectionEndpoint$p(org.springframework.security.config.annotation.web.OAuth2LoginDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2LoginDsl: public static final kotlin.jvm.functions.Function1 access$getUserInfoEndpoint$p(org.springframework.security.config.annotation.web.OAuth2LoginDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2ResourceServerDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2ResourceServerDsl: public static final kotlin.jvm.functions.Function1 access$getJwt$p(org.springframework.security.config.annotation.web.OAuth2ResourceServerDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OAuth2ResourceServerDsl: public static final kotlin.jvm.functions.Function1 access$getOpaqueToken$p(org.springframework.security.config.annotation.web.OAuth2ResourceServerDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OidcLogoutDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OidcLogoutDsl: public static final kotlin.jvm.functions.Function1 access$getBackChannel$p(org.springframework.security.config.annotation.web.OidcLogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.OneTimeTokenLoginDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.PasswordManagementDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.PortMapperDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.PortMapperDsl: public static final java.util.List access$getMappings$p(org.springframework.security.config.annotation.web.PortMapperDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.RememberMeDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.RequestCacheDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.RequiresChannelDsl: public final kotlin.jvm.functions.Function1.ChannelRequestMatcherRegistry, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.RequiresChannelDsl: public static final java.util.List access$getChannelSecurityRules$p(org.springframework.security.config.annotation.web.RequiresChannelDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.RequiresChannelDsl: public static final java.lang.String access$getHANDLER_MAPPING_INTROSPECTOR_BEAN_NAME$p(org.springframework.security.config.annotation.web.RequiresChannelDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.Saml2Dsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.Saml2Dsl: public static final kotlin.Pair access$getDefaultSuccessUrlOption$p(org.springframework.security.config.annotation.web.Saml2Dsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.Saml2LogoutDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.Saml2LogoutDsl: public static final kotlin.jvm.functions.Function1 access$getLogoutRequest$p(org.springframework.security.config.annotation.web.Saml2LogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.Saml2LogoutDsl: public static final kotlin.jvm.functions.Function1 access$getLogoutResponse$p(org.springframework.security.config.annotation.web.Saml2LogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.Saml2MetadataDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.SecurityContextDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.SessionManagementDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.SessionManagementDsl: public static final kotlin.jvm.functions.Function1 access$getSessionFixation$p(org.springframework.security.config.annotation.web.SessionManagementDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.SessionManagementDsl: public static final kotlin.jvm.functions.Function1 access$getSessionConcurrency$p(org.springframework.security.config.annotation.web.SessionManagementDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.WebAuthnDsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.X509Dsl: public final kotlin.jvm.functions.Function1, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.builders.HttpSecurity(org.springframework.security.config.annotation.ObjectPostProcessor, org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder, java.util.Map, java.lang.Object>) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer headers() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.CorsConfigurer cors() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer sessionManagement() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.PortMapperConfigurer portMapper() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.JeeConfigurer jee() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.X509Configurer x509() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.RememberMeConfigurer rememberMe() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry authorizeRequests() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.builders.HttpSecurity authorizeRequests(org.springframework.security.config.Customizer.ExpressionInterceptUrlRegistry>) throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry authorizeHttpRequests() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.RequestCacheConfigurer requestCache() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.ExceptionHandlingConfigurer exceptionHandling() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.SecurityContextConfigurer securityContext() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.ServletApiConfigurer servletApi() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.CsrfConfigurer csrf() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.LogoutConfigurer logout() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.AnonymousConfigurer anonymous() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.FormLoginConfigurer formLogin() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.saml2.Saml2LoginConfigurer saml2Login() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer saml2Logout() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.saml2.Saml2MetadataConfigurer saml2Metadata() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer oauth2Login() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2ClientConfigurer oauth2Client() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer oauth2ResourceServer() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer.ChannelRequestMatcherRegistry requiresChannel() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.configurers.HttpBasicConfigurer httpBasic() throws java.lang.Exception [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity: public org.springframework.security.config.annotation.web.builders.HttpSecurity$RequestMatcherConfigurer securityMatchers() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.HttpSecurity$RequestMatcherConfigurer: public org.springframework.security.config.annotation.web.builders.HttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.builders.WebSecurity: public org.springframework.security.config.annotation.web.builders.WebSecurity(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configuration.WebSecurityConfiguration: public static org.springframework.beans.factory.config.BeanFactoryPostProcessor conversionServicePostProcessor() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer: public T withObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$AuthorizationManagerRequestMatcherRegistry: public org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry withObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$AuthorizationManagerRequestMatcherRegistry: public org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer.AuthorizationManagerRequestMatcherRegistry shouldFilterAllDispatcherTypes(boolean) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.AuthorizeHttpRequestsConfigurer$AuthorizationManagerRequestMatcherRegistry: public H and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer$ChannelRequestMatcherRegistry: public org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer.ChannelRequestMatcherRegistry withObjectPostProcessor(org.springframework.security.config.annotation.ObjectPostProcessor) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer$ChannelRequestMatcherRegistry: public H and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.ContentTypeOptionsConfig contentTypeOptions() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.XXssConfig xssProtection() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.CacheControlConfig cacheControl() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.HstsConfig httpStrictTransportSecurity() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.FrameOptionsConfig frameOptions() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.HpkpConfig httpPublicKeyPinning() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.ContentSecurityPolicyConfig contentSecurityPolicy(java.lang.String) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.ReferrerPolicyConfig referrerPolicy() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.ReferrerPolicyConfig referrerPolicy(org.springframework.security.web.header.writers.ReferrerPolicyHeaderWriter$ReferrerPolicy) [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.PermissionsPolicyConfig permissionsPolicy() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.CrossOriginOpenerPolicyConfig crossOriginOpenerPolicy() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.CrossOriginEmbedderPolicyConfig crossOriginEmbedderPolicy() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.CrossOriginResourcePolicyConfig crossOriginResourcePolicy() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$CacheControlConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$ContentSecurityPolicyConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$ContentTypeOptionsConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$CrossOriginEmbedderPolicyConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$CrossOriginOpenerPolicyConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$CrossOriginResourcePolicyConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$FrameOptionsConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$HstsConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$PermissionsPolicyConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$ReferrerPolicyConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.HeadersConfigurer$XXssConfig: public org.springframework.security.config.annotation.web.configurers.HeadersConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer$ConcurrencyControlConfigurer: public org.springframework.security.config.annotation.web.configurers.SessionManagementConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2ClientConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2ClientConfigurer.AuthorizationCodeGrantConfigurer authorizationCodeGrant() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2ClientConfigurer$AuthorizationCodeGrantConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2ClientConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer.AuthorizationEndpointConfig authorizationEndpoint() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer.TokenEndpointConfig tokenEndpoint() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer.RedirectionEndpointConfig redirectionEndpoint() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer.UserInfoEndpointConfig userInfoEndpoint() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer$AuthorizationEndpointConfig: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer$RedirectionEndpointConfig: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer$TokenEndpointConfig: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer$UserInfoEndpointConfig: public org.springframework.security.config.annotation.web.configurers.oauth2.client.OAuth2LoginConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcLogoutConfigurer: public B and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.client.OidcLogoutConfigurer: public org.springframework.security.config.annotation.SecurityBuilder and() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer.JwtConfigurer jwt() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer.OpaqueTokenConfigurer opaqueToken() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer$JwtConfigurer: public org.springframework.security.config.annotation.web.configurers.oauth2.server.resource.OAuth2ResourceServerConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer: public org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer.LogoutRequestConfigurer logoutRequest() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer: public org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer.LogoutResponseConfigurer logoutResponse() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer$LogoutRequestConfigurer: public org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer$LogoutResponseConfigurer: public org.springframework.security.config.annotation.web.configurers.saml2.Saml2LogoutConfigurer and() [deprecated in 6.5] + member org.springframework.security.config.annotation.web.configurers.saml2.Saml2MetadataConfigurer: public org.springframework.security.config.annotation.SecurityBuilder and() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.CacheControlDsl: public final kotlin.jvm.functions.Function1.CacheControlConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.CacheControlDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.headers.CacheControlDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.ContentSecurityPolicyDsl: public final kotlin.jvm.functions.Function1.ContentSecurityPolicyConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.ContentTypeOptionsDsl: public final kotlin.jvm.functions.Function1.ContentTypeOptionsConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.ContentTypeOptionsDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.headers.ContentTypeOptionsDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.CrossOriginEmbedderPolicyDsl: public final kotlin.jvm.functions.Function1.CrossOriginEmbedderPolicyConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.CrossOriginOpenerPolicyDsl: public final kotlin.jvm.functions.Function1.CrossOriginOpenerPolicyConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.CrossOriginResourcePolicyDsl: public final kotlin.jvm.functions.Function1.CrossOriginResourcePolicyConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.FrameOptionsDsl: public final kotlin.jvm.functions.Function1.FrameOptionsConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.FrameOptionsDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.headers.FrameOptionsDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.HttpPublicKeyPinningDsl: public final kotlin.jvm.functions.Function1.HpkpConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.HttpPublicKeyPinningDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.headers.HttpPublicKeyPinningDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.HttpStrictTransportSecurityDsl: public final kotlin.jvm.functions.Function1.HstsConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.HttpStrictTransportSecurityDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.headers.HttpStrictTransportSecurityDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.PermissionsPolicyDsl: public final kotlin.jvm.functions.Function1.PermissionsPolicyConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.ReferrerPolicyDsl: public final kotlin.jvm.functions.Function1.ReferrerPolicyConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.XssProtectionConfigDsl: public final kotlin.jvm.functions.Function1.XXssConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.headers.XssProtectionConfigDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.annotation.web.headers.XssProtectionConfigDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.client.AuthorizationCodeGrantDsl: public final kotlin.jvm.functions.Function1.AuthorizationCodeGrantConfigurer, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.login.AuthorizationEndpointDsl: public final kotlin.jvm.functions.Function1.AuthorizationEndpointConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.login.OidcBackChannelLogoutDsl: public final kotlin.jvm.functions.Function1.BackChannelLogoutConfigurer, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.login.RedirectionEndpointDsl: public final kotlin.jvm.functions.Function1.RedirectionEndpointConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.login.TokenEndpointDsl: public final kotlin.jvm.functions.Function1.TokenEndpointConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.login.UserInfoEndpointDsl: public final kotlin.jvm.functions.Function1.UserInfoEndpointConfig, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.resourceserver.JwtDsl: public final kotlin.jvm.functions.Function1.JwtConfigurer, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.resourceserver.OpaqueTokenDsl: public final kotlin.jvm.functions.Function1.OpaqueTokenConfigurer, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.oauth2.resourceserver.OpaqueTokenDsl: public static final kotlin.Pair access$getClientCredentials$p(org.springframework.security.config.annotation.web.oauth2.resourceserver.OpaqueTokenDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.saml2.LogoutRequestDsl: public final kotlin.jvm.functions.Function1.LogoutRequestConfigurer, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.saml2.LogoutResponseDsl: public final kotlin.jvm.functions.Function1.LogoutResponseConfigurer, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.session.SessionConcurrencyDsl: public final kotlin.jvm.functions.Function1.ConcurrencyControlConfigurer, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.session.SessionConcurrencyDsl: public static final org.springframework.security.web.authentication.session.SessionLimit access$getSessionLimit$p(org.springframework.security.config.annotation.web.session.SessionConcurrencyDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.session.SessionFixationDsl: public final kotlin.jvm.functions.Function1.SessionFixationConfigurer, kotlin.Unit> get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.annotation.web.session.SessionFixationDsl: public static final org.springframework.security.config.annotation.web.session.SessionFixationStrategy access$getStrategy$p(org.springframework.security.config.annotation.web.session.SessionFixationDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.http.MatcherType: public static final org.springframework.security.config.http.MatcherType ant [NOT deprecated in 6.5] + member org.springframework.security.config.http.MatcherType: public static final org.springframework.security.config.http.MatcherType mvc [NOT deprecated in 6.5] + member org.springframework.security.config.http.MessageMatcherFactoryBean: public void setPathMatcher(org.springframework.util.PathMatcher) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.AuthorizeExchangeDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.AuthorizeExchangeDsl: public static final java.util.List access$getAuthorizationRules$p(org.springframework.security.config.web.server.AuthorizeExchangeDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerAnonymousDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerAnonymousDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerAnonymousDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCacheControlDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCacheControlDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerCacheControlDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerContentSecurityPolicyDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerContentTypeOptionsDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerContentTypeOptionsDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerContentTypeOptionsDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCorsDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCorsDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerCorsDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCrossOriginEmbedderPolicyDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCrossOriginOpenerPolicyDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCrossOriginResourcePolicyDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCsrfDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerCsrfDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerCsrfDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerExceptionHandlingDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerFormLoginDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerFormLoginDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerFormLoginDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerFrameOptionsDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerFrameOptionsDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerFrameOptionsDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getContentTypeOptions$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getXssProtection$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getCacheControl$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getHsts$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getFrameOptions$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getContentSecurityPolicy$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final java.lang.String access$getFeaturePolicyDirectives$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getPermissionsPolicy$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getReferrerPolicy$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getCrossOriginOpenerPolicy$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getCrossOriginEmbedderPolicy$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final kotlin.jvm.functions.Function1 access$getCrossOriginResourcePolicy$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final java.util.List access$getWriters$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHeadersDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerHeadersDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpBasicDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpBasicDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerHttpBasicDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$HttpsRedirectSpec redirectToHttps() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$CsrfSpec csrf() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$CorsSpec cors() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$AnonymousSpec anonymous() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$HttpBasicSpec httpBasic() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$PasswordManagementSpec passwordManagement() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$FormLoginSpec formLogin() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$X509Spec x509() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2LoginSpec oauth2Login() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ClientSpec oauth2Client() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec oauth2ResourceServer() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec headers() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$ExceptionHandlingSpec exceptionHandling() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$AuthorizeExchangeSpec authorizeExchange() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$LogoutSpec logout() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity: public org.springframework.security.config.web.server.ServerHttpSecurity$RequestCacheSpec requestCache() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$AnonymousSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$AnonymousSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$AuthorizeExchangeSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$CorsSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$CorsSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$CsrfSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$CsrfSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$ExceptionHandlingSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$FormLoginSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$FormLoginSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$CacheSpec cache() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$ContentTypeOptionsSpec contentTypeOptions() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$FrameOptionsSpec frameOptions() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$HstsSpec hsts() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$XssProtectionSpec xssProtection() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$ContentSecurityPolicySpec contentSecurityPolicy(java.lang.String) [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$PermissionsPolicySpec permissionsPolicy() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$ReferrerPolicySpec referrerPolicy(org.springframework.security.web.server.header.ReferrerPolicyServerHttpHeadersWriter$ReferrerPolicy) [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$ReferrerPolicySpec referrerPolicy() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$CrossOriginOpenerPolicySpec crossOriginOpenerPolicy() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$CrossOriginEmbedderPolicySpec crossOriginEmbedderPolicy() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$CrossOriginResourcePolicySpec crossOriginResourcePolicy() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$ContentSecurityPolicySpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$CrossOriginEmbedderPolicySpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$CrossOriginOpenerPolicySpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$CrossOriginResourcePolicySpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$HstsSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$PermissionsPolicySpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec$ReferrerPolicySpec: public org.springframework.security.config.web.server.ServerHttpSecurity$HeaderSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HttpBasicSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HttpBasicSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$HttpsRedirectSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$LogoutSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$LogoutSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ClientSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ClientSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2LoginSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2LoginSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$JwtSpec jwt() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$OpaqueTokenSpec opaqueToken() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$JwtSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$OpaqueTokenSpec: public org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$OpaqueTokenSpec: protected org.springframework.security.authentication.ReactiveAuthenticationManager getAuthenticationManager() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$OpaqueTokenSpec: protected org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenIntrospector getIntrospector() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$OpaqueTokenSpec: protected org.springframework.security.oauth2.server.resource.introspection.ReactiveOpaqueTokenAuthenticationConverter getAuthenticationConverter() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OAuth2ResourceServerSpec$OpaqueTokenSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OidcLogoutSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$OneTimeTokenLoginSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$PasswordManagementSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$PasswordManagementSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$RequestCacheSpec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$RequestCacheSpec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$X509Spec: public org.springframework.security.config.web.server.ServerHttpSecurity and() [deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurity$X509Spec: protected void configure(org.springframework.security.config.web.server.ServerHttpSecurity) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpSecurityDsl: public final org.springframework.security.web.server.SecurityWebFilterChain build$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpStrictTransportSecurityDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpStrictTransportSecurityDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerHttpStrictTransportSecurityDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpsRedirectDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpsRedirectDsl: public static final org.springframework.security.web.server.util.matcher.ServerWebExchangeMatcher[] access$getRedirectMatchers$p(org.springframework.security.config.web.server.ServerHttpsRedirectDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerHttpsRedirectDsl: public static final kotlin.jvm.functions.Function1 access$getRedirectMatcherFunction$p(org.springframework.security.config.web.server.ServerHttpsRedirectDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerJwtDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerLogoutDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerLogoutDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerLogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOAuth2ClientDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOAuth2LoginDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOAuth2ResourceServerDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOAuth2ResourceServerDsl: public static final kotlin.jvm.functions.Function1 access$getJwt$p(org.springframework.security.config.web.server.ServerOAuth2ResourceServerDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOAuth2ResourceServerDsl: public static final kotlin.jvm.functions.Function1 access$getOpaqueToken$p(org.springframework.security.config.web.server.ServerOAuth2ResourceServerDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOidcBackChannelLogoutDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOidcLogoutDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOidcLogoutDsl: public static final kotlin.jvm.functions.Function1 access$getBackChannel$p(org.springframework.security.config.web.server.ServerOidcLogoutDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOneTimeTokenLoginDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOpaqueTokenDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerOpaqueTokenDsl: public static final kotlin.Pair access$getClientCredentials$p(org.springframework.security.config.web.server.ServerOpaqueTokenDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerPasswordManagementDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerPermissionsPolicyDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerReferrerPolicyDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerRequestCacheDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerRequestCacheDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerRequestCacheDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerSessionConcurrencyDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerSessionManagementDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerSessionManagementDsl: public static final kotlin.jvm.functions.Function1 access$getSessionConcurrency$p(org.springframework.security.config.web.server.ServerSessionManagementDsl) [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerX509Dsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerXssProtectionDsl: public final kotlin.jvm.functions.Function1 get$spring_security_config() [NOT deprecated in 6.5] + member org.springframework.security.config.web.server.ServerXssProtectionDsl: public static final boolean access$getDisabled$p(org.springframework.security.config.web.server.ServerXssProtectionDsl) [NOT deprecated in 6.5] +== spring-security-web: public classes removed: 102, members removed from classes that remain: 28, new classes: 83 + class org.springframework.security.web.PortResolver [deprecated in 6.5; gone] + class org.springframework.security.web.PortResolverImpl [deprecated in 6.5; gone] + class org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.HandlerMappingIntrospectorRequestTransformer [deprecated in 6.5; gone] + class org.springframework.security.web.access.channel.AbstractRetryEntryPoint [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.ChannelDecisionManager [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.ChannelDecisionManagerImpl [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.ChannelEntryPoint [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.ChannelProcessingFilter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.ChannelProcessor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.InsecureChannelProcessor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.RetryWithHttpEntryPoint [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.RetryWithHttpsEntryPoint [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.channel.SecureChannelProcessor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.expression.DefaultWebSecurityExpressionHandler [NOT deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.expression.WebExpressionVoter [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.access.intercept.FilterSecurityInterceptor [deprecated in 6.5; moved to spring-security-access] + class org.springframework.security.web.csrf.LazyCsrfTokenRepository [deprecated in 6.5; gone] + class org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher [deprecated in 6.5; gone] + class org.springframework.security.web.servlet.util.matcher.MvcRequestMatcher$Builder [NOT deprecated in 6.5; gone] + class org.springframework.security.web.util.matcher.AntPathRequestMatcher [deprecated in 6.5; gone] + class org.springframework.security.web.util.matcher.RequestVariablesExtractor [deprecated in 6.5; gone] + class org.springframework.security.web.webauthn.api.AttestationConveyancePreference [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticationExtensionsClientInput [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticationExtensionsClientInputs [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticationExtensionsClientOutput [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticationExtensionsClientOutputs [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorAssertionResponse [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorAssertionResponse$AuthenticatorAssertionResponseBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorAttachment [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorAttestationResponse [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorAttestationResponse$AuthenticatorAttestationResponseBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorResponse [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorSelectionCriteria [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorSelectionCriteria$AuthenticatorSelectionCriteriaBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.AuthenticatorTransport [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.Bytes [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.COSEAlgorithmIdentifier [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput$CredProtect [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.CredProtectAuthenticationExtensionsClientInput$CredProtect$ProtectionPolicy [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.CredentialPropertiesOutput [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.CredentialPropertiesOutput$ExtensionOutput [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.CredentialRecord [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInput [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientInputs [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ImmutableAuthenticationExtensionsClientOutputs [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ImmutableCredentialRecord [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ImmutableCredentialRecord$ImmutableCredentialRecordBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ImmutablePublicKeyCose [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ImmutablePublicKeyCredentialUserEntity [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ImmutablePublicKeyCredentialUserEntity$PublicKeyCredentialUserEntityBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCose [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredential [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredential$PublicKeyCredentialBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialCreationOptions [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialCreationOptions$PublicKeyCredentialCreationOptionsBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialDescriptor [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialDescriptor$PublicKeyCredentialDescriptorBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialParameters [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialRequestOptions$PublicKeyCredentialRequestOptionsBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialRpEntity [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialRpEntity$PublicKeyCredentialRpEntityBuilder [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialType [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.PublicKeyCredentialUserEntity [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.ResidentKeyRequirement [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.api.UserVerificationRequirement [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.authentication.HttpSessionPublicKeyCredentialRequestOptionsRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.authentication.PublicKeyCredentialRequestOptionsFilter [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.authentication.PublicKeyCredentialRequestOptionsRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.authentication.WebAuthnAuthentication [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationFilter [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationProvider [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.authentication.WebAuthnAuthenticationRequestToken [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.jackson.WebauthnJackson2Module [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.CredentialRecordOwnerAuthorizationManager [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.ImmutablePublicKeyCredentialCreationOptionsRequest [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.ImmutablePublicKeyCredentialRequestOptionsRequest [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.ImmutableRelyingPartyRegistrationRequest [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.JdbcPublicKeyCredentialUserEntityRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.JdbcUserCredentialRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.MapPublicKeyCredentialUserEntityRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.MapUserCredentialRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.PublicKeyCredentialCreationOptionsRequest [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.PublicKeyCredentialRequestOptionsRequest [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.PublicKeyCredentialUserEntityRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.RelyingPartyAuthenticationRequest [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.RelyingPartyPublicKey [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.RelyingPartyRegistrationRequest [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.UserCredentialRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.WebAuthnRelyingPartyOperations [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.management.Webauthn4JRelyingPartyOperations [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.registration.DefaultWebAuthnRegistrationPageGeneratingFilter [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.registration.HttpSessionPublicKeyCredentialCreationOptionsRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.registration.PublicKeyCredentialCreationOptionsFilter [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.registration.PublicKeyCredentialCreationOptionsRepository [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.registration.WebAuthnRegistrationFilter [NOT deprecated in 6.5; moved to spring-security-webauthn] + class org.springframework.security.web.webauthn.registration.WebAuthnRegistrationFilter$SuccessfulUserRegistrationResponse [NOT deprecated in 6.5; moved to spring-security-webauthn] + member org.springframework.security.web.access.IpAddressAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, org.springframework.security.web.access.intercept.RequestAuthorizationContext) [NOT deprecated in 6.5] + member org.springframework.security.web.access.IpAddressAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.web.access.expression.WebExpressionAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, org.springframework.security.web.access.intercept.RequestAuthorizationContext) [NOT deprecated in 6.5] + member org.springframework.security.web.access.expression.WebExpressionAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.web.access.intercept.AuthorizationFilter: public void setShouldFilterAllDispatcherTypes(boolean) [deprecated in 6.5] + member org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, jakarta.servlet.http.HttpServletRequest) [deprecated in 6.5] + member org.springframework.security.web.access.intercept.RequestMatcherDelegatingAuthorizationManager: public org.springframework.security.authorization.AuthorizationDecision check(java.util.function.Supplier, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint: public void setPortResolver(org.springframework.security.web.PortResolver) [deprecated in 6.5] + member org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint: protected org.springframework.security.web.PortResolver getPortResolver() [deprecated in 6.5] + member org.springframework.security.web.csrf.CookieCsrfTokenRepository: public void setCookieHttpOnly(boolean) [deprecated in 6.5] + member org.springframework.security.web.csrf.CookieCsrfTokenRepository: public void setCookieDomain(java.lang.String) [deprecated in 6.5] + member org.springframework.security.web.csrf.CookieCsrfTokenRepository: public void setSecure(java.lang.Boolean) [deprecated in 6.5] + member org.springframework.security.web.csrf.CookieCsrfTokenRepository: public void setCookieMaxAge(int) [deprecated in 6.5] + member org.springframework.security.web.savedrequest.DefaultSavedRequest: public org.springframework.security.web.savedrequest.DefaultSavedRequest(jakarta.servlet.http.HttpServletRequest, org.springframework.security.web.PortResolver) [deprecated in 6.5] + member org.springframework.security.web.savedrequest.DefaultSavedRequest: public org.springframework.security.web.savedrequest.DefaultSavedRequest(jakarta.servlet.http.HttpServletRequest, org.springframework.security.web.PortResolver, java.lang.String) [deprecated in 6.5] + member org.springframework.security.web.savedrequest.DefaultSavedRequest: public boolean doesRequestMatch(jakarta.servlet.http.HttpServletRequest, org.springframework.security.web.PortResolver) [deprecated in 6.5] + member org.springframework.security.web.savedrequest.HttpSessionRequestCache: public void setPortResolver(org.springframework.security.web.PortResolver) [deprecated in 6.5] + member org.springframework.security.web.savedrequest.SavedCookie: public org.springframework.security.web.savedrequest.SavedCookie(java.lang.String, java.lang.String, java.lang.String, java.lang.String, int, java.lang.String, boolean, int) [deprecated in 6.5] + member org.springframework.security.web.savedrequest.SavedCookie: public java.lang.String getComment() [deprecated in 6.5] + member org.springframework.security.web.savedrequest.SavedCookie: public int getVersion() [deprecated in 6.5] + member org.springframework.security.web.server.authorization.DelegatingReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, org.springframework.web.server.ServerWebExchange) [deprecated in 6.5] + member org.springframework.security.web.server.authorization.DelegatingReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.web.server.authorization.IpAddressReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, org.springframework.security.web.server.authorization.AuthorizationContext) [NOT deprecated in 6.5] + member org.springframework.security.web.server.authorization.IpAddressReactiveAuthorizationManager: public reactor.core.publisher.Mono check(reactor.core.publisher.Mono, java.lang.Object) [NOT deprecated in 6.5] + member org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository: public void setCookieHttpOnly(boolean) [deprecated in 6.5] + member org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository: public void setCookieDomain(java.lang.String) [deprecated in 6.5] + member org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository: public void setSecure(boolean) [deprecated in 6.5] + member org.springframework.security.web.server.csrf.CookieServerCsrfTokenRepository: public void setCookieMaxAge(int) [deprecated in 6.5] +== spring-security-crypto: public classes removed: 1, members removed from classes that remain: 28, new classes: 22 + class org.springframework.security.crypto.codec.Base64 [deprecated in 6.5; gone] + member org.springframework.security.crypto.argon2.Argon2PasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.argon2.Argon2PasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.argon2.Argon2PasswordEncoder: public boolean upgradeEncoding(java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder: public boolean upgradeEncoding(java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.AbstractPasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.AbstractPasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.AbstractPasswordEncoder: protected abstract byte[] encode(java.lang.CharSequence, byte[]) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.AbstractPasswordEncoder: protected static boolean matches(byte[], byte[]) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.DelegatingPasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.DelegatingPasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.DelegatingPasswordEncoder: public boolean upgradeEncoding(java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.LdapShaPasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.LdapShaPasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.Md4PasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.Md4PasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.MessageDigestPasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.MessageDigestPasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.NoOpPasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.NoOpPasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.Pbkdf2PasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.Pbkdf2PasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.StandardPasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.password.StandardPasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.scrypt.SCryptPasswordEncoder: public java.lang.String encode(java.lang.CharSequence) [NOT deprecated in 6.5] + member org.springframework.security.crypto.scrypt.SCryptPasswordEncoder: public boolean matches(java.lang.CharSequence, java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.crypto.scrypt.SCryptPasswordEncoder: public boolean upgradeEncoding(java.lang.String) [NOT deprecated in 6.5] +== spring-security-oauth2-core: public classes removed: 0, members removed from classes that remain: 16, new classes: 17 + member org.springframework.security.oauth2.core.AuthorizationGrantType: public static final org.springframework.security.oauth2.core.AuthorizationGrantType PASSWORD [deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder authorizationUri(java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder clientId(java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder redirectUri(java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder scope(java.lang.String...) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder scopes(java.util.Set) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder state(java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder additionalParameters(java.util.Map) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder additionalParameters(java.util.function.Consumer>) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder parameters(java.util.function.Consumer>) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder attributes(java.util.Map) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder attributes(java.util.function.Consumer>) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder authorizationRequestUri(java.lang.String) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder: public org.springframework.security.oauth2.core.endpoint.OAuth2AuthorizationRequest$Builder authorizationRequestUri(java.util.function.Function) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames: public static final java.lang.String USERNAME [NOT deprecated in 6.5] + member org.springframework.security.oauth2.core.endpoint.OAuth2ParameterNames: public static final java.lang.String PASSWORD [NOT deprecated in 6.5] +== spring-security-oauth2-client: public classes removed: 18, members removed from classes that remain: 10, new classes: 64 + class org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder$PasswordGrantBuilder [NOT deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.PasswordOAuth2AuthorizedClientProvider [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.PasswordReactiveOAuth2AuthorizedClientProvider [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientProviderBuilder$PasswordGrantBuilder [NOT deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.DefaultAuthorizationCodeTokenResponseClient [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.DefaultClientCredentialsTokenResponseClient [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.DefaultJwtBearerTokenResponseClient [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.DefaultPasswordTokenResponseClient [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.DefaultRefreshTokenTokenResponseClient [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.DefaultTokenExchangeTokenResponseClient [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.JwtBearerGrantRequestEntityConverter [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.OAuth2AuthorizationCodeGrantRequestEntityConverter [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.OAuth2ClientCredentialsGrantRequestEntityConverter [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequest [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.OAuth2PasswordGrantRequestEntityConverter [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.OAuth2RefreshTokenGrantRequestEntityConverter [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.TokenExchangeGrantRequestEntityConverter [deprecated in 6.5; gone] + class org.springframework.security.oauth2.client.endpoint.WebClientReactivePasswordTokenResponseClient [deprecated in 6.5; gone] + member org.springframework.security.oauth2.client.OAuth2AuthorizationContext: public static final java.lang.String USERNAME_ATTRIBUTE_NAME [NOT deprecated in 6.5] + member org.springframework.security.oauth2.client.OAuth2AuthorizationContext: public static final java.lang.String PASSWORD_ATTRIBUTE_NAME [NOT deprecated in 6.5] + member org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder: public org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder password() [deprecated in 6.5] + member org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder: public org.springframework.security.oauth2.client.OAuth2AuthorizedClientProviderBuilder password(java.util.function.Consumer) [deprecated in 6.5] + member org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientProviderBuilder: public org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientProviderBuilder password() [deprecated in 6.5] + member org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientProviderBuilder: public org.springframework.security.oauth2.client.ReactiveOAuth2AuthorizedClientProviderBuilder password(java.util.function.Consumer) [deprecated in 6.5] + member org.springframework.security.oauth2.client.http.OAuth2ErrorResponseErrorHandler: public void handleError(org.springframework.http.client.ClientHttpResponse) throws java.io.IOException [NOT deprecated in 6.5] + member org.springframework.security.oauth2.client.oidc.userinfo.OidcReactiveOAuth2UserService: public final void setOidcUserMapper(java.util.function.BiFunction>) [NOT deprecated in 6.5] + member org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService: public final void setAccessibleScopes(java.util.Set) [deprecated in 6.5] + member org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService: public final void setOidcUserMapper(java.util.function.BiFunction) [NOT deprecated in 6.5] +== spring-security-oauth2-resource-server: public classes removed: 4, members removed from classes that remain: 4, new classes: 30 + class org.springframework.security.oauth2.server.resource.BearerTokenAuthenticationToken [deprecated in 6.5; gone] + class org.springframework.security.oauth2.server.resource.introspection.NimbusOpaqueTokenIntrospector [deprecated in 6.5; gone] + class org.springframework.security.oauth2.server.resource.introspection.NimbusReactiveOpaqueTokenIntrospector [deprecated in 6.5; gone] + class org.springframework.security.oauth2.server.resource.web.BearerTokenAuthenticationFilter [deprecated in 6.5; gone] + member org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver: public org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver(java.lang.String...) [deprecated in 6.5] + member org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver: public org.springframework.security.oauth2.server.resource.authentication.JwtIssuerAuthenticationManagerResolver(java.util.Collection) [deprecated in 6.5] + member org.springframework.security.oauth2.server.resource.authentication.JwtIssuerReactiveAuthenticationManagerResolver: public org.springframework.security.oauth2.server.resource.authentication.JwtIssuerReactiveAuthenticationManagerResolver(java.lang.String...) [deprecated in 6.5] + member org.springframework.security.oauth2.server.resource.authentication.JwtIssuerReactiveAuthenticationManagerResolver: public org.springframework.security.oauth2.server.resource.authentication.JwtIssuerReactiveAuthenticationManagerResolver(java.util.Collection) [deprecated in 6.5] +== spring-security-oauth2-jose: public classes removed: 0, members removed from classes that remain: 0, new classes: 14 +== spring-security-test: public classes removed: 0, members removed from classes that remain: 0, new classes: 9 +TOTAL public classes missing from the old jars: 203, of which found again in spring-security-access, spring-security-webauthn: 151 diff --git a/security-7-migration/output/03-matchers-6.5.11.txt b/security-7-migration/output/03-matchers-6.5.11.txt new file mode 100644 index 0000000..531803e --- /dev/null +++ b/security-7-migration/output/03-matchers-6.5.11.txt @@ -0,0 +1,46 @@ +Spring Security 6.5.11 +pattern /api/** + /api ant=true pathPattern=true + /api/ ant=true pathPattern=true + /api/x/y ant=true pathPattern=true + /API/x ant=false pathPattern=false + /files/a.png ant=false pathPattern=false + /files/a.PNG ant=false pathPattern=false + /a/b ant=false pathPattern=false + /a/x/y/b ant=false pathPattern=false + /users/7 ant=false pathPattern=false + /users/7/ ant=false pathPattern=false +pattern /files/*.png + /api ant=false pathPattern=false + /api/ ant=false pathPattern=false + /api/x/y ant=false pathPattern=false + /API/x ant=false pathPattern=false + /files/a.png ant=true pathPattern=true + /files/a.PNG ant=false pathPattern=false + /a/b ant=false pathPattern=false + /a/x/y/b ant=false pathPattern=false + /users/7 ant=false pathPattern=false + /users/7/ ant=false pathPattern=false +pattern /a/**/b + /api ant=false pathPattern=n/a + /api/ ant=false pathPattern=n/a + /api/x/y ant=false pathPattern=n/a + /API/x ant=false pathPattern=n/a + /files/a.png ant=false pathPattern=n/a + /files/a.PNG ant=false pathPattern=n/a + /a/b ant=true pathPattern=n/a + /a/x/y/b ant=true pathPattern=n/a + /users/7 ant=false pathPattern=n/a + /users/7/ ant=false pathPattern=n/a + PathPatternRequestMatcher rejects the pattern: PatternParseException: {*...} or ** pattern elements should be placed at the start or end of the pattern +pattern /users/{id} + /api ant=false pathPattern=false + /api/ ant=false pathPattern=false + /api/x/y ant=false pathPattern=false + /API/x ant=false pathPattern=false + /files/a.png ant=false pathPattern=false + /files/a.PNG ant=false pathPattern=false + /a/b ant=false pathPattern=false + /a/x/y/b ant=false pathPattern=false + /users/7 ant=true pathPattern=true + /users/7/ ant=false pathPattern=false diff --git a/security-7-migration/output/03-matchers-7.1.2.txt b/security-7-migration/output/03-matchers-7.1.2.txt new file mode 100644 index 0000000..65661d5 --- /dev/null +++ b/security-7-migration/output/03-matchers-7.1.2.txt @@ -0,0 +1,47 @@ +Spring Security 7.1.2 +AntPathRequestMatcher: class not on the class path +pattern /api/** + /api ant=- pathPattern=true + /api/ ant=- pathPattern=true + /api/x/y ant=- pathPattern=true + /API/x ant=- pathPattern=false + /files/a.png ant=- pathPattern=false + /files/a.PNG ant=- pathPattern=false + /a/b ant=- pathPattern=false + /a/x/y/b ant=- pathPattern=false + /users/7 ant=- pathPattern=false + /users/7/ ant=- pathPattern=false +pattern /files/*.png + /api ant=- pathPattern=false + /api/ ant=- pathPattern=false + /api/x/y ant=- pathPattern=false + /API/x ant=- pathPattern=false + /files/a.png ant=- pathPattern=true + /files/a.PNG ant=- pathPattern=false + /a/b ant=- pathPattern=false + /a/x/y/b ant=- pathPattern=false + /users/7 ant=- pathPattern=false + /users/7/ ant=- pathPattern=false +pattern /a/**/b + /api ant=- pathPattern=n/a + /api/ ant=- pathPattern=n/a + /api/x/y ant=- pathPattern=n/a + /API/x ant=- pathPattern=n/a + /files/a.png ant=- pathPattern=n/a + /files/a.PNG ant=- pathPattern=n/a + /a/b ant=- pathPattern=n/a + /a/x/y/b ant=- pathPattern=n/a + /users/7 ant=- pathPattern=n/a + /users/7/ ant=- pathPattern=n/a + PathPatternRequestMatcher rejects the pattern: PatternParseException: {*...} or ** pattern elements should be placed at the start or end of the pattern +pattern /users/{id} + /api ant=- pathPattern=false + /api/ ant=- pathPattern=false + /api/x/y ant=- pathPattern=false + /API/x ant=- pathPattern=false + /files/a.png ant=- pathPattern=false + /files/a.PNG ant=- pathPattern=false + /a/b ant=- pathPattern=false + /a/x/y/b ant=- pathPattern=false + /users/7 ant=- pathPattern=true + /users/7/ ant=- pathPattern=false diff --git a/security-7-migration/output/04-global-method-security-6.5.11.txt b/security-7-migration/output/04-global-method-security-6.5.11.txt new file mode 100644 index 0000000..2a17f66 --- /dev/null +++ b/security-7-migration/output/04-global-method-security-6.5.11.txt @@ -0,0 +1,2 @@ +Spring Security 6.5.11 +blocked: AuthenticationCredentialsNotFoundException diff --git a/security-7-migration/output/04-global-method-security-7.1.2-with-access.txt b/security-7-migration/output/04-global-method-security-7.1.2-with-access.txt new file mode 100644 index 0000000..a1ccbb6 --- /dev/null +++ b/security-7-migration/output/04-global-method-security-7.1.2-with-access.txt @@ -0,0 +1,2 @@ +Spring Security 7.1.2 +blocked: AuthenticationCredentialsNotFoundException diff --git a/security-7-migration/output/04-global-method-security-7.1.2.txt b/security-7-migration/output/04-global-method-security-7.1.2.txt new file mode 100644 index 0000000..f4be6f1 --- /dev/null +++ b/security-7-migration/output/04-global-method-security-7.1.2.txt @@ -0,0 +1,2 @@ +Spring Security 7.1.2 +context failed to start: @EnableGlobalMethodSecurity requires the spring-security-access dependency on the classpath. Please add spring-security-access, or migrate to @EnableMethodSecurity which does not require it. diff --git a/security-7-migration/output/05-old-apis-6.5.11.txt b/security-7-migration/output/05-old-apis-6.5.11.txt new file mode 100644 index 0000000..5704068 --- /dev/null +++ b/security-7-migration/output/05-old-apis-6.5.11.txt @@ -0,0 +1,39 @@ +Spring Security 6.5.11, compiling OldSecurity.java +src/compat/OldSecurity.java:16: warning: [deprecation] EnableGlobalMethodSecurity in org.springframework.security.config.annotation.method.configuration has been deprecated +@EnableGlobalMethodSecurity(prePostEnabled = true) + ^ +warning: [deprecation] ExpressionUrlAuthorizationConfigurer in org.springframework.security.config.annotation.web.configurers has been deprecated +warning: [deprecation] ExpressionUrlAuthorizationConfigurer.ExpressionInterceptUrlRegistry in ExpressionUrlAuthorizationConfigurer has been deprecated +src/compat/OldSecurity.java:20: warning: [removal] authorizeRequests(Customizer.ExpressionInterceptUrlRegistry>) in HttpSecurity has been deprecated and marked for removal + http.authorizeRequests(a -> a.anyRequest().authenticated()); + ^ +src/compat/OldSecurity.java:24: warning: [removal] csrf() in HttpSecurity has been deprecated and marked for removal + http.csrf().disable().headers().frameOptions().sameOrigin(); + ^ +src/compat/OldSecurity.java:24: warning: [removal] headers() in HttpSecurity has been deprecated and marked for removal + http.csrf().disable().headers().frameOptions().sameOrigin(); + ^ +src/compat/OldSecurity.java:24: warning: [removal] frameOptions() in HeadersConfigurer has been deprecated and marked for removal + http.csrf().disable().headers().frameOptions().sameOrigin(); + ^ + where H is a type-variable: + H extends HttpSecurityBuilder declared in class HeadersConfigurer +src/compat/OldSecurity.java:28: warning: [removal] AntPathRequestMatcher in org.springframework.security.web.util.matcher has been deprecated and marked for removal + return new AntPathRequestMatcher("/api/**"); + ^ +src/compat/OldSecurity.java:32: warning: [deprecation] DaoAuthenticationProvider() in DaoAuthenticationProvider has been deprecated + DaoAuthenticationProvider p = new DaoAuthenticationProvider(); + ^ +src/compat/OldSecurity.java:33: warning: [deprecation] setUserDetailsService(UserDetailsService) in DaoAuthenticationProvider has been deprecated + p.setUserDetailsService(users); + ^ +src/compat/OldSecurity.java:38: warning: [removal] PASSWORD in AuthorizationGrantType has been deprecated and marked for removal + return AuthorizationGrantType.PASSWORD; + ^ +src/compat/OldSecurity.java:43: warning: [deprecation] check(Supplier,T) in AuthorizationManager has been deprecated + public AuthorizationDecision check(Supplier authentication, RequestAuthorizationContext ctx) { + ^ + where T is a type-variable: + T extends Object declared in interface AuthorizationManager +12 warnings +javac exit status: 0 diff --git a/security-7-migration/output/05-old-apis-7.1.2.txt b/security-7-migration/output/05-old-apis-7.1.2.txt new file mode 100644 index 0000000..c8e4a71 --- /dev/null +++ b/security-7-migration/output/05-old-apis-7.1.2.txt @@ -0,0 +1,50 @@ +Spring Security 7.1.2, compiling OldSecurity.java +src/compat/OldSecurity.java:11: error: cannot find symbol +import org.springframework.security.web.util.matcher.AntPathRequestMatcher; + ^ + symbol: class AntPathRequestMatcher + location: package org.springframework.security.web.util.matcher +src/compat/OldSecurity.java:16: warning: [deprecation] EnableGlobalMethodSecurity in org.springframework.security.config.annotation.method.configuration has been deprecated +@EnableGlobalMethodSecurity(prePostEnabled = true) + ^ +src/compat/OldSecurity.java:20: error: cannot find symbol + http.authorizeRequests(a -> a.anyRequest().authenticated()); + ^ + symbol: method authorizeRequests((a)->a.any[...]ted()) + location: variable http of type HttpSecurity +src/compat/OldSecurity.java:24: error: method csrf in class HttpSecurity cannot be applied to given types; + http.csrf().disable().headers().frameOptions().sameOrigin(); + ^ + required: Customizer> + found: no arguments + reason: actual and formal argument lists differ in length +src/compat/OldSecurity.java:28: error: cannot find symbol + return new AntPathRequestMatcher("/api/**"); + ^ + symbol: class AntPathRequestMatcher + location: class OldSecurity +src/compat/OldSecurity.java:32: error: constructor DaoAuthenticationProvider in class DaoAuthenticationProvider cannot be applied to given types; + DaoAuthenticationProvider p = new DaoAuthenticationProvider(); + ^ + required: UserDetailsService + found: no arguments + reason: actual and formal argument lists differ in length +src/compat/OldSecurity.java:33: error: cannot find symbol + p.setUserDetailsService(users); + ^ + symbol: method setUserDetailsService(UserDetailsService) + location: variable p of type DaoAuthenticationProvider +src/compat/OldSecurity.java:38: error: cannot find symbol + return AuthorizationGrantType.PASSWORD; + ^ + symbol: variable PASSWORD + location: class AuthorizationGrantType +src/compat/OldSecurity.java:41: error: CustomManager is not abstract and does not override abstract method authorize(Supplier,RequestAuthorizationContext) in AuthorizationManager + static class CustomManager implements AuthorizationManager { + ^ +src/compat/OldSecurity.java:42: error: method does not override or implement a method from a supertype + @Override + ^ +9 errors +1 warning +javac exit status: 1 diff --git a/security-7-migration/output/06-fixed-apis-6.5.11.txt b/security-7-migration/output/06-fixed-apis-6.5.11.txt new file mode 100644 index 0000000..eec2022 --- /dev/null +++ b/security-7-migration/output/06-fixed-apis-6.5.11.txt @@ -0,0 +1,2 @@ +Spring Security 6.5.11, compiling NewSecurity.java +javac exit status: 0 diff --git a/security-7-migration/output/06-fixed-apis-7.1.2.txt b/security-7-migration/output/06-fixed-apis-7.1.2.txt new file mode 100644 index 0000000..2a34d2a --- /dev/null +++ b/security-7-migration/output/06-fixed-apis-7.1.2.txt @@ -0,0 +1,2 @@ +Spring Security 7.1.2, compiling NewSecurity.java +javac exit status: 0 diff --git a/security-7-migration/output/07-new-manager-6.5.11.txt b/security-7-migration/output/07-new-manager-6.5.11.txt new file mode 100644 index 0000000..fe99ea5 --- /dev/null +++ b/security-7-migration/output/07-new-manager-6.5.11.txt @@ -0,0 +1,9 @@ +Spring Security 6.5.11, compiling NewManager.java +src/compat/NewManager.java:10: error: NewManager is not abstract and does not override abstract method check(Supplier,RequestAuthorizationContext) in AuthorizationManager +class NewManager implements AuthorizationManager { +^ +src/compat/NewManager.java:11: error: method does not override or implement a method from a supertype + @Override + ^ +2 errors +javac exit status: 1 diff --git a/security-7-migration/output/07-new-manager-7.1.2.txt b/security-7-migration/output/07-new-manager-7.1.2.txt new file mode 100644 index 0000000..666c238 --- /dev/null +++ b/security-7-migration/output/07-new-manager-7.1.2.txt @@ -0,0 +1,2 @@ +Spring Security 7.1.2, compiling NewManager.java +javac exit status: 0 diff --git a/security-7-migration/pom.xml b/security-7-migration/pom.xml new file mode 100644 index 0000000..840b567 --- /dev/null +++ b/security-7-migration/pom.xml @@ -0,0 +1,85 @@ + + + 4.0.0 + + com.ankurm + security-7-migration + 1.0.0 + security-7-migration + Spring Security 6.5.11 vs 7.1.2: jar diff, old-API compile checks and a runtime check - companion for ankurm.com + + + 17 + UTF-8 + + 4.1.2 + 7.1.2 + + + + + security6 + + 3.5.16 + 6.5.11 + + + + security7 + + 4.1.2 + 7.1.2 + + + + + + + + + org.springframework.security + spring-security-bom + ${security.version} + pom + import + + + org.springframework.boot + spring-boot-dependencies + ${boot.version} + pom + import + + + + + + + org.springframework.security + spring-security-config + + + org.springframework.security + spring-security-web + + + org.springframework.security + spring-security-oauth2-client + + + org.springframework + spring-test + + + org.springframework.security + spring-security-test + + + jakarta.servlet + jakarta.servlet-api + provided + + + diff --git a/security-7-migration/scripts/api_diff.py b/security-7-migration/scripts/api_diff.py new file mode 100644 index 0000000..d32102b --- /dev/null +++ b/security-7-migration/scripts/api_diff.py @@ -0,0 +1,176 @@ +#!/usr/bin/env python3 +"""Compare the public API of Spring Security 6.5.11 against 7.1.2 straight from the jars. + +Writes output/01-versions-and-baseline.txt and output/02-removed-api.txt. +Needs a JDK (javap) on PATH or via JAVA_HOME, and access to Maven Central. +""" +import collections +import os +import pathlib +import re +import subprocess +import time +import urllib.error +import urllib.request +import zipfile + +ROOT = pathlib.Path(__file__).resolve().parent.parent +JARS = ROOT / "target" / "jars" +OUT = ROOT / "output" +JAVAP = os.path.join(os.environ["JAVA_HOME"], "bin", "javap") if os.environ.get("JAVA_HOME") else "javap" + +OLD, NEW = "6.5.11", "7.1.2" +ARTIFACTS = [("security", a) for a in ["spring-security-core","spring-security-config","spring-security-web","spring-security-crypto","spring-security-oauth2-core","spring-security-oauth2-client","spring-security-oauth2-resource-server","spring-security-oauth2-jose","spring-security-test"]] + + +# New 7.x artifacts that took over classes: a class missing from its old jar may simply have moved here. +RELOCATION_TARGETS = ["spring-security-access", "spring-security-webauthn"] + + +def version_for(group, which): + return NEW if which == "new" else OLD + + +def fetch(url, dest): + if dest.exists(): + return + for _ in range(8): + try: + with urllib.request.urlopen(url) as r: + dest.write_bytes(r.read()) + return + except urllib.error.HTTPError as e: + if e.code != 429: + raise + time.sleep(4) + raise RuntimeError("rate limited: " + url) + + +def jar(group, artifact, which): + v = version_for(group, which) + dest = JARS / f"{artifact}-{v}.jar" + fetch(f"https://repo1.maven.org/maven2/org/springframework/security/{artifact}/{v}/{artifact}-{v}.jar", dest) + return dest + + +def classes(path): + with zipfile.ZipFile(path) as z: + return sorted(n[:-6].replace("/", ".") for n in z.namelist() + if n.endswith(".class") and not n.endswith("module-info.class") and "META-INF" not in n) + + +def major(path): + with zipfile.ZipFile(path) as z: + name = next(n for n in z.namelist() + if n.endswith(".class") and not n.endswith("module-info.class") and "META-INF" not in n) + b = z.read(name) + return int.from_bytes(b[6:8], "big") + + +def norm(sig): + """Erase generics and the throws clause, so only a real change of name, parameters or return type counts.""" + sig = re.sub(r"\s+throws\s+.*$", "", sig) + prev = None + while prev != sig: + prev = sig + sig = re.sub(r"<[^<>]*>", "", sig) + return " ".join(sig.split()) + + +MEMBER = re.compile(r"^ ((?:public|protected)[^;]*);$") + + +def dump(path): + """One javap call per jar. Returns {class: (is_public, class_deprecated, {member signature: deprecated?})}.""" + names = [c for c in classes(path) if ".internal." not in c] + result = {} + # javap takes many class names at once; split the list to keep the command line short + for i in range(0, len(names), 150): + chunk = names[i:i + 150] + p = subprocess.run([JAVAP, "-v", "-protected", "-cp", str(path)] + chunk, capture_output=True, text=True) + cur_cls = None + for block in re.split(r"(?m)^Classfile ", p.stdout)[1:]: + lines = block.splitlines() + header = lines[0] + cls = re.search(r"!/(.*)\.class", header).group(1).replace("/", ".") + public = False + cls_dep = False + members, cur, in_pool, seen_flags = {}, None, False, False + for line in lines[1:]: + if not seen_flags and line.startswith(" flags:"): + public = "ACC_PUBLIC" in line + seen_flags = True + if line.startswith("Constant pool:"): + in_pool = True + continue + if in_pool: + if line.startswith("{"): + in_pool = False + continue + m = MEMBER.match(line) + if m: + cur = " ".join(m.group(1).split()) + members[cur] = False + continue + if line.strip() == "Deprecated: true": + if cur is None: + cls_dep = True + else: + members[cur] = True + if line.startswith("}"): + cur = None + if re.search(r"^Deprecated: true", block, re.M): + cls_dep = True + result[cls] = (public, cls_dep, members) + return result + + +def main(): + JARS.mkdir(parents=True, exist_ok=True) + OUT.mkdir(parents=True, exist_ok=True) + versions = [f"{'artifact':<34} {'6.x jar':<28} {'7.x jar':<28}"] + moved_to = {} + for art in RELOCATION_TARGETS: + j = jar("security", art, "new") + for c in classes(j): + moved_to[c] = art + removed_classes = collections.defaultdict(list) + removed_members = collections.defaultdict(list) + added = collections.Counter() + for group, art in ARTIFACTS: + old, new = jar(group, art, "old"), jar(group, art, "new") + mo, mn = major(old), major(new) + versions.append(f"{art:<34} {version_for(group, 'old')} (Java {mo - 44}){'':<9} {NEW} (Java {mn - 44})") + do, dn = dump(old), dump(new) + co, cn = set(classes(old)), set(classes(new)) + for c in sorted(co - cn): + if c in do and do[c][0]: + removed_classes[art].append((c, do[c][1])) + added[art] = len(cn - co) + for c in sorted(do): + if c in dn and do[c][0]: + new_norm = {norm(x) for x in dn[c][2]} + for sig, dep in do[c][2].items(): + if norm(sig) not in new_norm: + removed_members[art].append((c, sig, dep)) + (OUT / "01-versions-and-baseline.txt").write_text("\n".join(versions) + "\n") + lines = [] + for _, art in ARTIFACTS: + lines.append(f"== {art}: public classes removed: {len(removed_classes[art])}, " + f"members removed from classes that remain: {len(removed_members[art])}, " + f"new classes: {added[art]}") + for c, dep in removed_classes[art]: + note = f"; moved to {moved_to[c]}" if c in moved_to else "; gone" + lines.append(f" class {c} [{'deprecated in 6.5' if dep else 'NOT deprecated in 6.5'}{note}]") + for c, sig, dep in removed_members[art]: + lines.append(f" member {c}: {sig} [{'deprecated in 6.5' if dep else 'NOT deprecated in 6.5'}]") + moved = sum(1 for a in removed_classes for c, _ in removed_classes[a] if c in moved_to) + total = sum(len(v) for v in removed_classes.values()) + lines.append(f"TOTAL public classes missing from the old jars: {total}, of which found again in {', '.join(RELOCATION_TARGETS)}: {moved}") + (OUT / "02-removed-api.txt").write_text("\n".join(lines) + "\n") + print("\n".join(versions)) + print("\n".join(l for l in lines if l.startswith("=="))) + + +if __name__ == "__main__": + main() diff --git a/security-7-migration/scripts/compile-old-apis.sh b/security-7-migration/scripts/compile-old-apis.sh new file mode 100755 index 0000000..88ca4b5 --- /dev/null +++ b/security-7-migration/scripts/compile-old-apis.sh @@ -0,0 +1,18 @@ +#!/usr/bin/env bash +# Compiles src/compat/*.java against Security 6.5.11 and 7.1.2 and records javac's answer in output/. +set -u +cd "$(dirname "$0")/.." +mkdir -p target output +for pair in "security6:6.5.11" "security7:7.1.2"; do + profile=${pair%%:*}; v=${pair##*:} + mvn -q -B dependency:build-classpath -P$profile -Dmdep.outputFile=target/cp-$v.txt >/dev/null || { echo "classpath failed for $v"; exit 1; } + for f in OldSecurity NewSecurity NewManager; do + out=output/$( [ $f = OldSecurity ] && echo 05-old-apis || { [ $f = NewSecurity ] && echo 06-fixed-apis || echo 07-new-manager; } )-$v.txt + rm -rf target/classes-$f-$v; mkdir -p target/classes-$f-$v + { + echo "Spring Security $v, compiling $f.java" + javac -Xlint:deprecation -proc:none -d target/classes-$f-$v -cp "$(cat target/cp-$v.txt)" src/compat/$f.java 2>&1 | grep -v "^Picked up" + echo "javac exit status: ${PIPESTATUS[0]}" + } > $out + done +done diff --git a/security-7-migration/scripts/run-all.sh b/security-7-migration/scripts/run-all.sh new file mode 100755 index 0000000..d20f657 --- /dev/null +++ b/security-7-migration/scripts/run-all.sh @@ -0,0 +1,7 @@ +#!/usr/bin/env bash +# Rewrites everything in output/. Needs JDK 17+, Maven 3.9 and internet access to Maven Central. +set -e +cd "$(dirname "$0")/.." +python3 scripts/api_diff.py +./scripts/compile-old-apis.sh +./scripts/run-probes.sh diff --git a/security-7-migration/scripts/run-probes.sh b/security-7-migration/scripts/run-probes.sh new file mode 100755 index 0000000..da2803a --- /dev/null +++ b/security-7-migration/scripts/run-probes.sh @@ -0,0 +1,20 @@ +#!/usr/bin/env bash +# Runs the two probes on both Security lines; writes output/03-* and output/04-*. +set -u +cd "$(dirname "$0")/.." +mkdir -p target output +for pair in "security6:6.5.11" "security7:7.1.2"; do + profile=${pair%%:*}; v=${pair##*:} + mvn -q -B dependency:build-classpath -P$profile -Dmdep.outputFile=target/cp-$v.txt >/dev/null || exit 1 + rm -rf target/probe-$v; mkdir -p target/probe-$v + javac -proc:none -d target/probe-$v -cp "$(cat target/cp-$v.txt)" src/probe/*.java 2>&1 | grep -v "^Picked up" + java -cp "target/probe-$v:$(cat target/cp-$v.txt)" MatcherProbe 2>&1 | grep -vE "^Picked up|SpringSecurityCoreVersion|^INFO:" > output/03-matchers-$v.txt + java -cp "target/probe-$v:$(cat target/cp-$v.txt)" MethodSecurityProbe 2>&1 | grep -vE "^Picked up|SpringSecurityCoreVersion|^INFO:|^WARNING:|AnnotationConfigApplicationContext refresh" > output/04-global-method-security-$v.txt +done + +# 7.1.2 again, with the spring-security-access jar that api_diff.py downloaded added to the class path +ACC=target/jars/spring-security-access-7.1.2.jar +if [ -f "$ACC" ]; then + java -cp "target/probe-7.1.2:$ACC:$(cat target/cp-7.1.2.txt)" MethodSecurityProbe 2>&1 \ + | grep -vE "^Picked up|SpringSecurityCoreVersion|^INFO:|^WARNING:|AnnotationConfigApplicationContext refresh" > output/04-global-method-security-7.1.2-with-access.txt +fi diff --git a/security-7-migration/src/compat/NewManager.java b/security-7-migration/src/compat/NewManager.java new file mode 100644 index 0000000..ff79e88 --- /dev/null +++ b/security-7-migration/src/compat/NewManager.java @@ -0,0 +1,15 @@ +import org.springframework.security.authorization.AuthorizationManager; +import org.springframework.security.authorization.AuthorizationResult; +import org.springframework.security.authorization.AuthorizationDecision; +import org.springframework.security.core.Authentication; +import org.springframework.security.web.access.intercept.RequestAuthorizationContext; + +import java.util.function.Supplier; + +/** The Security 7 shape of a custom AuthorizationManager. There is no single source that compiles on both lines. */ +class NewManager implements AuthorizationManager { + @Override + public AuthorizationResult authorize(Supplier authentication, RequestAuthorizationContext ctx) { + return new AuthorizationDecision(authentication.get().isAuthenticated()); + } +} diff --git a/security-7-migration/src/compat/NewSecurity.java b/security-7-migration/src/compat/NewSecurity.java new file mode 100644 index 0000000..4591a1c --- /dev/null +++ b/security-7-migration/src/compat/NewSecurity.java @@ -0,0 +1,27 @@ +import org.springframework.security.authentication.dao.DaoAuthenticationProvider; +import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.core.userdetails.UserDetailsService; +import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; +import org.springframework.security.web.util.matcher.RequestMatcher; + +/** The replacements for OldSecurity that exist in both lines, so they can be made before upgrading. */ +@EnableMethodSecurity +class NewSecurity { + + void chain(HttpSecurity http) throws Exception { + http.authorizeHttpRequests(a -> a.anyRequest().authenticated()); + } + + void chainWithLambdas(HttpSecurity http) throws Exception { + http.csrf(c -> c.disable()).headers(h -> h.frameOptions(f -> f.sameOrigin())); + } + + RequestMatcher matcher() { + return PathPatternRequestMatcher.withDefaults().matcher("/api/**"); + } + + DaoAuthenticationProvider provider(UserDetailsService users) { + return new DaoAuthenticationProvider(users); + } +} diff --git a/security-7-migration/src/compat/OldSecurity.java b/security-7-migration/src/compat/OldSecurity.java new file mode 100644 index 0000000..cfbccca --- /dev/null +++ b/security-7-migration/src/compat/OldSecurity.java @@ -0,0 +1,47 @@ +import org.springframework.security.access.annotation.Secured; +import org.springframework.security.authentication.dao.DaoAuthenticationProvider; +import org.springframework.security.authorization.AuthorizationDecision; +import org.springframework.security.authorization.AuthorizationManager; +import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.core.Authentication; +import org.springframework.security.core.userdetails.UserDetailsService; +import org.springframework.security.oauth2.core.AuthorizationGrantType; +import org.springframework.security.web.access.intercept.RequestAuthorizationContext; +import org.springframework.security.web.util.matcher.AntPathRequestMatcher; + +import java.util.function.Supplier; + +/** Security 6 style code. Compiled by scripts/compile-old-apis.sh against 6.5.11 and 7.1.2; not part of a Maven build. */ +@EnableGlobalMethodSecurity(prePostEnabled = true) +class OldSecurity { + + void chain(HttpSecurity http) throws Exception { + http.authorizeRequests(a -> a.anyRequest().authenticated()); + } + + void chainWithAnd(HttpSecurity http) throws Exception { + http.csrf().disable().headers().frameOptions().sameOrigin(); + } + + Object matcher() { + return new AntPathRequestMatcher("/api/**"); + } + + DaoAuthenticationProvider provider(UserDetailsService users) { + DaoAuthenticationProvider p = new DaoAuthenticationProvider(); + p.setUserDetailsService(users); + return p; + } + + Object grant() { + return AuthorizationGrantType.PASSWORD; + } + + static class CustomManager implements AuthorizationManager { + @Override + public AuthorizationDecision check(Supplier authentication, RequestAuthorizationContext ctx) { + return new AuthorizationDecision(authentication.get().isAuthenticated()); + } + } +} diff --git a/security-7-migration/src/probe/MatcherProbe.java b/security-7-migration/src/probe/MatcherProbe.java new file mode 100644 index 0000000..fc813d6 --- /dev/null +++ b/security-7-migration/src/probe/MatcherProbe.java @@ -0,0 +1,51 @@ +import org.springframework.mock.web.MockHttpServletRequest; +import org.springframework.security.web.servlet.util.matcher.PathPatternRequestMatcher; +import org.springframework.security.web.util.matcher.RequestMatcher; + +/** Runs the same patterns through the old Ant matcher (when the jar has it) and the PathPattern matcher. */ +public class MatcherProbe { + + static final String[] PATTERNS = {"/api/**", "/files/*.png", "/a/**/b", "/users/{id}"}; + static final String[] PATHS = {"/api", "/api/", "/api/x/y", "/API/x", "/files/a.png", "/files/a.PNG", "/a/b", "/a/x/y/b", "/users/7", "/users/7/"}; + + public static void main(String[] args) throws Exception { + System.out.println("Spring Security " + org.springframework.security.core.SpringSecurityCoreVersion.getVersion()); + Class ant = null; + try { + ant = Class.forName("org.springframework.security.web.util.matcher.AntPathRequestMatcher"); + } catch (ClassNotFoundException e) { + System.out.println("AntPathRequestMatcher: class not on the class path"); + } + for (String pattern : PATTERNS) { + System.out.println("pattern " + pattern); + RequestMatcher oldM = ant == null ? null : (RequestMatcher) ant.getConstructor(String.class).newInstance(pattern); + RequestMatcher newM = null; + String newError = null; + try { + newM = PathPatternRequestMatcher.withDefaults().matcher(pattern); + } catch (RuntimeException e) { + newError = e.getClass().getSimpleName() + ": " + e.getMessage(); + } + for (String path : PATHS) { + MockHttpServletRequest req = new MockHttpServletRequest("GET", path); + req.setServletPath(path); + req.setRequestURI(path); + String a = oldM == null ? "-" : String.valueOf(oldM.matches(req)); + String b; + if (newM == null) { + b = "n/a"; + } else { + try { + b = String.valueOf(newM.matches(req)); + } catch (RuntimeException e) { + b = e.getClass().getSimpleName(); + } + } + System.out.printf(" %-14s ant=%-6s pathPattern=%s%n", path, a, b); + } + if (newError != null) { + System.out.println(" PathPatternRequestMatcher rejects the pattern: " + newError); + } + } + } +} diff --git a/security-7-migration/src/probe/MethodSecurityProbe.java b/security-7-migration/src/probe/MethodSecurityProbe.java new file mode 100644 index 0000000..39d234c --- /dev/null +++ b/security-7-migration/src/probe/MethodSecurityProbe.java @@ -0,0 +1,47 @@ +import org.springframework.context.annotation.AnnotationConfigApplicationContext; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.access.prepost.PreAuthorize; +import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity; + +/** Does the deprecated @EnableGlobalMethodSecurity still enforce @PreAuthorize? Run with no Authentication in the context. */ +public class MethodSecurityProbe { + + static class Vault { + @PreAuthorize("hasRole('ADMIN')") + public String secret() { + return "the secret"; + } + } + + @Configuration + @EnableGlobalMethodSecurity(prePostEnabled = true) + static class Config { + @Bean + Vault vault() { + return new Vault(); + } + } + + public static void main(String[] args) { + System.out.println("Spring Security " + org.springframework.security.core.SpringSecurityCoreVersion.getVersion()); + try (var ctx = new AnnotationConfigApplicationContext()) { + ctx.register(Config.class); + try { + ctx.refresh(); + } catch (RuntimeException e) { + Throwable root = e; + while (root.getCause() != null) { + root = root.getCause(); + } + System.out.println("context failed to start: " + root.getMessage()); + return; + } + try { + System.out.println("returned: " + ctx.getBean(Vault.class).secret()); + } catch (RuntimeException e) { + System.out.println("blocked: " + e.getClass().getSimpleName()); + } + } + } +}