29,090 questions
Score of 1
1 answer
68 views
How does Spring Boot SecurityContextHolder works
I am quite struggling to understand how does even Spring
SecurityContextHolder
work internally I read too many articles but not able to understand it properly can anybody explain me how does it even ...
- reputation score 1
Score of 2
2 answers
85 views
Does @Order on a @Configuration class determine SecurityFilterChain precedence in Spring Security?
I'm trying to understand how Spring Security determines the order of multiple SecurityFilterChain beans.
The official documentation demonstrates applying @Order directly to the SecurityFilterChain ...
- reputation score 21
Score of 1
1 answer
90 views
Per-resource ACL with bitmask permissions in Spring — good approach? Scalable? What if I add roles later?
I'm building permission-based access control (ACL) in a Spring app. Resources are nested: User → Sheet → Transaction.
I want to store permissions as a bitmask instead of role rows. Is this a good ...
- reputation score 93
Score of 0
0 answers
116 views
"Cannot set the Security Context" console message
During obtaining the authentication token the following message appears in the Spring Boot application console.
Cannot set the Security Context
I think it's important that this message doesn't include ...
- reputation score 105
Score of 1
0 answers
118 views
Why does OncePerRequestFilter execute on permitAll() endpoints even when added via addFilterBefore in a SecurityFilterChain?
I have a Spring Security configuration with a SecurityFilterChain that uses authorizeHttpRequests to permit certain endpoints like /user/register without authentication. However I also have a custom ...
- reputation score 33
Advice
0
votes
1
replies
88
views
Is Spring Security 5.2.9.RELEASE affected by CVE-2026-22732?
Hello Spring Security team,
I have a question regarding CVE-2026-22732.
According to the advisory, the affected versions are listed as:
5.7.0 through 5.7.21
5.8.0 through 5.8.23
6.3.0 through 6.3....
- reputation score 1
Advice
0
votes
0
replies
69
views
MFA in Spring Security and Spring Authserver's authorization grant type flow
I'm wondering if people have experience setting up an Spring Authserver that has MFA enabled using Spring Security 7.x.x. The goal is for a user to start the authorization grant type flow by accessing ...
- reputation score 1
Advice
0
votes
1
replies
67
views
Regarding Implementation and understanding Filters in SpringBoot
I am a recently graduated student.I made a decision to become software developer,I know its weird because of current AI trend and impact on developers.But its not about that,I started learning java ...
- reputation score 1
Best practices
1
vote
1
replies
140
views
Configuring Spring Boot 3 (Spring MVC & Spring Security 7) for CORS public access (with credentials)
There are lots of good examples for how to configure Spring Boot for CORS online, but it seems to be very hard to find anything with an intersection of:
Using the APIs in Spring Boot 3 rather than ...
- reputation score 15320
Score of 1
1 answer
149 views
How to have a CorsConfigurationSource in an Autoconfiguration in Spring Boot?
I am building a company-specific Spring Boot autoconfiguration. The code looks something like this:
@AutoConfiguration
@AutoConfigureBefore(SecurityAutoConfiguration.class)
@...
- reputation score 27419
Score of 0
1 answer
145 views
Spring Boot OAuth2ResourceServer Excluding Paths (Cloudflare Turnstile)
I have a Spring Boot REST API written in Kotlin using Keycloak with Spring Security for authentication and authorization. I want to expose one endpoint publicly but protect it with Cloudflare ...
- reputation score 11
Score of 0
1 answer
65 views
Use OpenFeign to call microservices within an authenticated user session
I have a setup where I use Keycloak for user authentication. I use Spring Boot and Spring Security. My backend successfully performs the authentication with Keycloak using authorization_code grant and ...
- reputation score 3059
Score of 0
0 answers
53 views
The sec tag cannot be displayed in thymeleaf?
I'm learning the spring security module.
Here is my security configuration class:
@Configuration
@EnableWebSecurity
public class SecurityConfiguration {
@Bean
public SecurityFilterChain ...
- reputation score 13
Advice
0
votes
2
replies
141
views
Is Spring framework 6.x compatible with Spring Security 7.x?
Is Spring framework 6.x compatible with Spring Security 7.x? I need to upgrade a servlet-based web application to the latest version of Spring Security, but due to some dependency limitations I can't ...
- reputation score 1
Best practices
0
votes
4
replies
85
views
Working around spaghetti lambdas and builder in Spring Security v6
I am working to adapt Spring Security v6 in my application and one of the GitHub projects I am using as a model has the following filterChain implementation in its @EnableWebSecurity Configuration ...
- reputation score 31908
