Spring
Why Spring
Overview
  • Trending
    • Generative AI Cloud
  • Architecture Patterns
    • Microservices Reactive Event Driven
  • Application Types
    • Web Applications Serverless Batch
    Learn
  • Getting Started
    • Quickstart Guides
  • Academy
    • Courses Get Certified
    Projects
    Overview
  • Projects
    • Spring Boot Spring Framework Spring Cloud Spring AI Spring Data Spring Integration Spring Batch Spring Security
  • Foundational Projects
    • Micrometer Reactor
  • Development Tools
    • Spring Tools Spring Initializr
    Resources
    Blog Release Calendar Version Mappings Release Highlights Security Advisories
  • GitHub Orgs
    • Spring Projects Spring Cloud
    Community
    Overview Events Authors
    Enterprise
    Overview Long-term Support Automated Upgrades Governance and Compliance Modern App Development
    Spring Security 6.5.11
      • Overview
      • Prerequisites
      • Community
      • What’s New
      • Preparing for 7.0
        • Authentication
        • Authorization
        • Configuration
        • LDAP
        • Messaging
        • OAuth 2.0
        • SAML 2.0
        • Web
      • Migrating to 6
      • Getting Spring Security
      • Javadoc
      • Features
        • Authentication
          • Password Storage
        • Authorization
        • Protection Against Exploits
          • CSRF
          • HTTP Headers
          • HTTP Requests
        • Integrations
          • Cryptography
          • Spring Data
          • Java’s Concurrency APIs
          • Jackson
          • Localization
      • Project Modules
      • Samples
      • Servlet Applications
        • Getting Started
        • Architecture
        • Authentication
          • Authentication Architecture
          • Username/Password
            • Reading Username/Password
              • Form
              • Basic
              • Digest
            • Password Storage
              • In Memory
              • JDBC
              • UserDetails
              • CredentialsContainer
              • Password Erasure
              • UserDetailsService
              • PasswordEncoder
              • DaoAuthenticationProvider
              • LDAP
          • Persistence
          • Passkeys
          • One-Time Token
          • Session Management
          • Remember Me
          • Anonymous
          • Pre-Authentication
          • JAAS
          • CAS
          • X509
          • Run-As
          • Logout
          • Authentication Events
        • Authorization
          • Authorization Architecture
          • Authorize HTTP Requests
          • Method Security
          • Domain Object Security ACLs
          • Authorization Events
        • OAuth2
          • OAuth2 Log In
            • Core Configuration
            • Advanced Configuration
            • OIDC Logout
          • OAuth2 Client
            • Core Interfaces and Classes
            • OAuth2 Authorization Grants
            • OAuth2 Client Authentication
            • OAuth2 Authorized Clients
          • OAuth2 Resource Server
            • JWT
            • Opaque Token
            • Multitenancy
            • Bearer Tokens
            • DPoP-bound Access Tokens
        • SAML2
          • SAML2 Log In
            • SAML2 Log In Overview
            • SAML2 Authentication Requests
            • SAML2 Authentication Responses
          • SAML2 Logout
          • SAML2 Metadata
          • Migrating from Spring Security SAML Extension
        • Protection Against Exploits
          • Cross Site Request Forgery (CSRF)
          • Security HTTP Response Headers
          • HTTP
          • HttpFirewall
        • Integrations
          • Concurrency
          • Jackson
          • Localization
          • Servlet APIs
          • Spring Data
          • Spring MVC
          • WebSocket
          • Spring’s CORS Support
          • JSP Taglib
          • Observability
        • Configuration
          • Java Configuration
          • Kotlin Configuration
          • Namespace Configuration
        • Testing
          • Method Security
          • MockMvc Support
          • MockMvc Setup
          • Security RequestPostProcessors
            • Mocking Users
            • Mocking CSRF
            • Mocking Form Login
            • Mocking HTTP Basic
            • Mocking OAuth2
            • Mocking Logout
          • Security RequestBuilders
          • Security ResultMatchers
          • Security ResultHandlers
        • Appendix
          • Database Schemas
          • XML Namespace
            • Authentication Services
            • Web Security
            • Method Security
            • LDAP Security
            • WebSocket Security
          • Proxy Server Configuration
          • FAQ
      • Reactive Applications
        • Getting Started
        • Authentication
          • X.509 Authentication
          • Logout
          • Session Management
            • Concurrent Sessions Control
        • Authorization
          • Authorize HTTP Requests
          • EnableReactiveMethodSecurity
        • OAuth2
          • OAuth2 Log In
            • Core Configuration
            • Advanced Configuration
            • OIDC Logout
          • OAuth2 Client
            • Core Interfaces and Classes
            • OAuth2 Authorization Grants
            • OAuth2 Client Authentication
            • OAuth2 Authorized Clients
          • OAuth2 Resource Server
            • JWT
            • Opaque Token
            • Multitenancy
            • Bearer Tokens
        • Protection Against Exploits
          • CSRF
          • Headers
          • HTTP Requests
          • ServerWebExchangeFirewall
        • Integrations
          • CORS
          • RSocket
          • Observability
        • Testing
          • Testing Method Security
          • Testing Web Security
            • WebTestClient Setup
            • Testing Authentication
            • Testing CSRF
            • Testing OAuth 2.0
        • WebFlux Security
      • GraalVM Native Image Support
        • Method Security
    Edit this Page GitHub Project Stack Overflow
    • Spring Security
    • Preparing for 7.0
    • Authentication

    For the latest stable version, please use Spring Security 7.1.0!

    Authentication Changes

    • Spring Security
      • 7.1.0
      • 7.0.6
      • 6.5.11
      • 7.1.1-SNAPSHOT
      • 7.0.7-SNAPSHOT
      • 6.5.12-SNAPSHOT
    • Related Spring Documentation
      • Spring Framework
      • Spring Security
        • Spring Authorization Server
        • Spring LDAP
        • Spring Security Kerberos
        • Spring Session
        • Spring Vault
      • Spring GraphQL
      • All Docs...
    Spring

    Copyright © 2005 - Broadcom. All Rights Reserved. The term "Broadcom" refers to Broadcom Inc. and/or its subsidiaries.
    Terms of Use • Privacy • Trademark Guidelines • Thank you • Your California Privacy Rights • Cookie Settings

    Apache®, Apache Tomcat®, Apache Kafka®, Apache Cassandra™, and Apache Geode™ are trademarks or registered trademarks of the Apache Software Foundation in the United States and/or other countries. Java™, Java™ SE, Java™ EE, and OpenJDK™ are trademarks of Oracle and/or its affiliates. Kubernetes® is a registered trademark of the Linux Foundation in the United States and other countries. Linux® is the registered trademark of Linus Torvalds in the United States and other countries. Windows® and Microsoft® Azure are registered trademarks of Microsoft Corporation. “AWS” and “Amazon Web Services” are trademarks or registered trademarks of Amazon.com Inc. or its affiliates. All other trademarks and copyrights are property of their respective owners and are only mentioned for informative purposes. Other names may be trademarks of their respective owners.

    Search in all Spring Docs