29,082 questions
Score of 1
1 answer
71 views
How to preserve custom fields from an OAuth2 token response and use them in Spring Authorization Server JWT generation?
I am integrating a third-party OAuth2 Authorization Code provider with a Spring Security + Spring Authorization Server based application.
The provider supports only OAuth2 Authorization Code Flow and ...
- reputation score 51
Score of 2
1 answer
174 views
How can a Spring Security OAuth2 failure handler access the token used by the failed request?
My custom OAuth2AuthorizationFailureHandler can load the current cached token, but I need the token used by the request that failed so that invalidation does not remove its replacement. These can ...
- reputation score 97
Score of 1
1 answer
113 views
Spring Security: recommended way to handle per-user permissions with JWT without hitting the DB twice per request?
I'm using Spring Boot 3 / Spring Security 6 with JPA. My JWT contains only the user's email. On every request, my filter loads the User entity from the DB and puts it in the
SecurityContext:
String ...
- reputation score 59
Score of -2
1 answer
147 views
Modeling a hierarchical staff role system alongside a plain customer role: same User entity or split into Customer/Employee? [closed]
I'm building an e-commerce backend in Spring Boot with Spring Security. Currently I have a single User entity that implements UserDetails, used for both customers and staff (admins/managers/employees),...
- reputation score 59
Score of 0
2 answers
123 views
How does OAuth2AuthorizedClientManager handle concurrent token refresh in Spring Security?
I'm using Spring Boot 4.x / spring-boot-starter-oauth2-client with AuthorizedClientServiceOAuth2AuthorizedClientManager and InMemoryOAuth2AuthorizedClientService using the client-credentials grant.
My ...
- reputation score 21
Score of 0
1 answer
132 views
Duplicate call of FilterChainProxy with SpringSecurity, MVC and StringResponseBody
I encounter a strange behaviour in my Spring-Boot project (v4.0.6):
When I execute a Controller which returns ResponseEntity<StraingResponseBody> for writing NDJSON-Lines the FilterChainProxy of ...
- reputation score 58
Score of 2
1 answer
203 views
How does Spring Boot SecurityContextHolder works
I am quite struggling to understand how does even Spring
SecurityContextHolder
work internally I read too many articles but not able to understand it properly can anybody explain me how does it even ...
- reputation score 3
Score of 3
1 answer
167 views
Does @Order on a @Configuration class determine SecurityFilterChain precedence in Spring Security?
I'm trying to understand how Spring Security determines the order of multiple SecurityFilterChain beans.
The official documentation demonstrates applying @Order directly to the SecurityFilterChain ...
- reputation score 31
Score of 0
1 answer
101 views
Per-resource ACL with bitmask permissions in Spring — good approach? Scalable? What if I add roles later?
I'm building permission-based access control (ACL) in a Spring app. Resources are nested: User → Sheet → Transaction.
I want to store permissions as a bitmask instead of role rows. Is this a good ...
- reputation score 91
Score of 0
1 answer
130 views
"Cannot set the Security Context" console message
During obtaining the authentication token the following message appears in the Spring Boot application console.
Cannot set the Security Context
I think it's important that this message doesn't include ...
- reputation score 105
Score of 1
0 answers
131 views
Why does OncePerRequestFilter execute on permitAll() endpoints even when added via addFilterBefore in a SecurityFilterChain?
I have a Spring Security configuration with a SecurityFilterChain that uses authorizeHttpRequests to permit certain endpoints like /user/register without authentication. However I also have a custom ...
- reputation score 33
Score of -1
1 answer
167 views
Is Spring Security 5.2.9.RELEASE affected by CVE-2026-22732?
Hello Spring Security team,
I have a question regarding CVE-2026-22732.
According to the advisory, the affected versions are listed as:
5.7.0 through 5.7.21
5.8.0 through 5.8.23
6.3.0 through 6.3....
- reputation score 1
Score of 0
0 answers
78 views
MFA in Spring Security and Spring Authserver's authorization grant type flow
I'm wondering if people have experience setting up an Spring Authserver that has MFA enabled using Spring Security 7.x.x. The goal is for a user to start the authorization grant type flow by accessing ...
- reputation score 1
Score of -1
1 answer
76 views
Regarding Implementation and understanding Filters in SpringBoot
I am a recently graduated student.I made a decision to become software developer,I know its weird because of current AI trend and impact on developers.But its not about that,I started learning java ...
- reputation score 1
Score of 0
1 answer
166 views
Configuring Spring Boot 3 (Spring MVC & Spring Security 7) for CORS public access (with credentials)
There are lots of good examples for how to configure Spring Boot for CORS online, but it seems to be very hard to find anything with an intersection of:
Using the APIs in Spring Boot 3 rather than ...
- reputation score 15320
