| org.springframework.security.web.authentication.AnonymousAuthenticationFilter.applyAnonymousForThisRequest(HttpServletRequest) no obvious use case and can easily be achieved by other means | 
| org.springframework.security.core.AuthenticationException.clearExtraInformation() | 
| org.springframework.security.access.SecurityConfig.createSingleAttributeList(String) Use createList instead | 
| org.springframework.security.web.authentication.preauth.PreAuthenticatedGrantedAuthoritiesUserDetailsService.createuserDetails(Authentication, Collection extends GrantedAuthority>) | 
| org.springframework.security.core.AuthenticationException.getAuthentication() to avoid potential leaking of sensitive information (e.g. through serialization/remoting). | 
| org.springframework.security.cas.web.CasAuthenticationEntryPoint.getEncodeServiceUrlWithSessionId() since 3.0.0 because CAS is currently on 3.3.5. | 
| org.springframework.security.core.AuthenticationException.getExtraInformation() Use the exception message or use a custom exception if you really need additional information. | 
| org.springframework.security.web.FilterChainProxy.getFilterChainMap() | 
| org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.getFilterProcessesUrl() | 
| org.springframework.security.web.authentication.logout.LogoutFilter.getFilterProcessesUrl() | 
| org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.requiresAuthentication(HttpServletRequest, HttpServletResponse) | 
| org.springframework.security.core.AuthenticationException.setAuthentication(Authentication) | 
| org.springframework.security.web.authentication.www.BasicAuthenticationFilter.setAuthenticationEntryPoint(AuthenticationEntryPoint) Use constructor injection | 
| org.springframework.security.web.access.ExceptionTranslationFilter.setAuthenticationEntryPoint(AuthenticationEntryPoint) Use constructor | 
| org.springframework.security.web.authentication.www.BasicAuthenticationFilter.setAuthenticationManager(AuthenticationManager) Use constructor injection | 
| org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.setAuthenticationManager(AuthenticationManager) Use constructor injection | 
| org.springframework.security.authentication.ProviderManager.setClearExtraInformation(boolean) the extraInformationproperty is deprecated | 
| org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.setConvertToUpperCase(boolean) Convert case in the AuthenticationProviderusing aGrantedAuthoritiesMapper. | 
| org.springframework.security.access.vote.AbstractAccessDecisionManager.setDecisionVoters(List) Use constructor | 
| org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.setDefaultRole(String) Assign a default role in the AuthenticationProviderusing aGrantedAuthoritiesMapper. | 
| org.springframework.security.cas.web.CasAuthenticationEntryPoint.setEncodeServiceUrlWithSessionId(boolean) since 3.0.0 because CAS is currently on 3.3.5. | 
| org.springframework.security.web.session.ConcurrentSessionFilter.setExpiredUrl(String) use constructor injection instead | 
| org.springframework.security.web.FilterChainProxy.setFilterChainMap(Map>) Use the constructor which takes a List<SecurityFilterChain>instead. | 
| org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.setFilterProcessesUrl(String) | 
| org.springframework.security.web.authentication.logout.LogoutFilter.setFilterProcessesUrl(String) | 
| org.springframework.security.web.authentication.www.BasicAuthenticationFilter.setIgnoreFailure(boolean) Use the constructor which takes a single AuthenticationManager parameter | 
| org.springframework.security.authentication.AnonymousAuthenticationProvider.setKey(String) Use constructor injection | 
| org.springframework.security.authentication.RememberMeAuthenticationProvider.setKey(String) Use constructor injection | 
| org.springframework.security.web.authentication.AnonymousAuthenticationFilter.setKey(String) use constructor injection instead | 
| org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices.setKey(String) Use constructor injection | 
| org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint.setLoginFormUrl(String) use constructor injection | 
| org.springframework.security.authentication.ProviderManager.setParent(AuthenticationManager) Use constructor injection | 
| org.springframework.security.authentication.ProviderManager.setProviders(List) Use constructor injection | 
| org.springframework.security.web.authentication.rememberme.RememberMeAuthenticationFilter.setRememberMeServices(RememberMeServices) Use constructor injection | 
| org.springframework.security.web.savedrequest.RequestCacheAwareFilter.setRequestCache(RequestCache) Use constructor injection | 
| org.springframework.security.web.access.ExceptionTranslationFilter.setRequestCache(RequestCache) Use constructor | 
| org.springframework.security.web.authentication.session.SessionFixationProtectionStrategy.setRetainedAttributes(List) Override the extractAttributesmethod instead | 
| org.springframework.security.ldap.userdetails.DefaultLdapAuthoritiesPopulator.setRolePrefix(String) Map the authorities in the AuthenticationProviderusing aGrantedAuthoritiesMapper. | 
| org.springframework.security.web.context.SecurityContextPersistenceFilter.setSecurityContextRepository(SecurityContextRepository) Use constructor injection | 
| org.springframework.security.web.session.SessionManagementFilter.setSessionAuthenticationStrategy(SessionAuthenticationStrategy) Use constructor injection | 
| org.springframework.security.web.session.ConcurrentSessionFilter.setSessionRegistry(SessionRegistry) use constructor injection instead | 
| org.springframework.security.web.authentication.rememberme.PersistentTokenBasedRememberMeServices.setTokenRepository(PersistentTokenRepository) Use constructor injection | 
| org.springframework.security.web.authentication.AnonymousAuthenticationFilter.setUserAttribute(UserAttribute) use constructor injection instead | 
| org.springframework.security.cas.authentication.CasAuthenticationProvider.setUserDetailsService(UserDetailsService) | 
| org.springframework.security.web.authentication.rememberme.AbstractRememberMeServices.setUserDetailsService(UserDetailsService) Use constructor injection | 
| org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.successfulAuthentication(HttpServletRequest, HttpServletResponse, Authentication) |