Overview Prerequisites Community What’s New Preparing for 7.0 Configuration Migrating to 6.0 Servlet Migrations Session Management Exploit Protection Authentication Authorization Reactive Migrations Getting Spring Security Features Authentication Password Storage Authorization Protection Against Exploits CSRF HTTP Headers HTTP Requests Integrations Cryptography Spring Data Java’s Concurrency APIs Jackson Localization Project Modules Samples Servlet Applications Getting Started Architecture Authentication Authentication Architecture Username/Password Reading Username/Password Form Basic Digest ** Password Storage In Memory JDBC UserDetails UserDetailsService PasswordEncoder DaoAuthenticationProvider LDAP Persistence Session Management Remember Me Anonymous Pre-Authentication JAAS CAS X509 Run-As Logout Authentication Events Authorization Authorization Architecture Authorize HTTP Requests Method Security Domain Object Security ACLs Authorization Events OAuth2 OAuth2 Log In Core Configuration Advanced Configuration OAuth2 Client Core Interfaces and Classes OAuth2 Authorization Grants OAuth2 Client Authentication OAuth2 Authorized Clients OAuth2 Resource Server JWT Opaque Token Multitenancy Bearer Tokens SAML2 SAML2 Log In SAML2 Log In Overview SAML2 Authentication Requests SAML2 Authentication Responses SAML2 Logout SAML2 Metadata Protection Against Exploits servlet/exploits/csrf.adoc servlet/exploits/headers.adoc servlet/exploits/http.adoc servlet/exploits/firewall.adoc Integrations Concurrency Jackson Localization Servlet APIs Spring Data Spring MVC WebSocket Spring’s CORS Support JSP Taglib Observability Configuration Java Configuration Kotlin Configuration Namespace Configuration Testing Method Security MockMvc Support MockMvc Setup Security RequestPostProcessors Mocking Users Mocking CSRF Mocking Form Login Mocking HTTP Basic Mocking OAuth2 Mocking Logout Security RequestBuilders Security ResultMatchers Security ResultHandlers Appendix Database Schemas XML Namespace Authentication Services Web Security Method Security LDAP Security WebSocket Security Proxy Server Configuration FAQ Reactive Applications Getting Started Authentication X.509 Authentication Logout Authorization Authorize HTTP Requests EnableReactiveMethodSecurity OAuth2 OAuth2 Log In Core Configuration Advanced Configuration OAuth2 Client Core Interfaces and Classes OAuth2 Authorization Grants OAuth2 Client Authentication OAuth2 Authorized Clients OAuth2 Resource Server JWT Opaque Token Multitenancy Bearer Tokens Protection Against Exploits CSRF Headers HTTP Requests Integrations CORS RSocket Observability Testing Testing Method Security Testing Web Security WebTestClient Setup Testing Authentication Testing CSRF Testing OAuth 2.0 WebFlux Security GraalVM Native Image Support Method Security