What’s New in Spring Security 7.2

gh-17655 - Make One-Time Token account status checks opt-in

Since Spring Framework’s HttpMethod#valueOf now normalizes casing, StrictServerWebExchangeFirewall no longer detects a non-canonical-case HTTP method (for example, get instead of GET) as a distinct value; such requests are processed as the canonical method instead of being rejected. Applications with a customized ServerExchangeRejectedHandler should be aware it is no longer invoked for this case.

gh-18895 - Add authenticationSuccessHandler to the Reactive Resource Server DSL

gh-19850 - RestClientOpaqueTokenIntrospector and SpringOpaqueTokenIntrospector now set Content-Type to application/x-www-form-urlencoded; added RestClientOpaqueTokenIntrospector#setRequestBodyCustomizer to override it if needed