Deprecated API

Contents

• Terminally Deprecated
• Interfaces
• Classes
• Annotation Interfaces
• Fields
• Methods
• Constructors
• Enum Constants

Terminally Deprecated Elements

Element	Description
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.permissionsPolicy(Customizer<HeadersConfigurer.PermissionsPolicyConfig>)	For removal in 7.0. Use HeadersConfigurer.permissionsPolicyHeader(Customizer) instead
org.springframework.security.config.web.server.ServerHttpSecurity.HeaderSpec.FeaturePolicySpec.and()	For removal in 7.0. Use #featurePolicy(Customizer) instead
org.springframework.security.core.SpringSecurityCoreVersion.SERIAL_VERSION_UID	Please have each class use its own serialization version
org.springframework.security.oauth2.client.oidc.userinfo.OidcReactiveOAuth2UserService.setOidcUserMapper(BiFunction<OidcUserRequest, OidcUserInfo, Mono<OidcUser>>)	Use OidcReactiveOAuth2UserService.setOidcUserConverter(Converter) instead
org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService.setAccessibleScopes(Set<String>)	Use OidcUserService.setRetrieveUserInfo(Predicate) instead
org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService.setOidcUserMapper(BiFunction<OidcUserRequest, OidcUserInfo, OidcUser>)	Use OidcUserService.setOidcUserConverter(Converter) instead
org.springframework.security.oauth2.server.resource.introspection.SpringOpaqueTokenIntrospector(String, String, String)	Please use SpringOpaqueTokenIntrospector.Builder
org.springframework.security.oauth2.server.resource.introspection.SpringReactiveOpaqueTokenIntrospector(String, String, String)	Please use SpringReactiveOpaqueTokenIntrospector.Builder
org.springframework.security.web.access.channel.AbstractRetryEntryPoint.getPortResolver()
org.springframework.security.web.access.channel.AbstractRetryEntryPoint.setPortResolver(PortResolver)
org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint.getPortResolver()
org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint.setPortResolver(PortResolver)
org.springframework.security.web.PortResolver	This existed for an old IE bug and is no longer need.
org.springframework.security.web.PortResolverImpl	This existed for an old IE bug and is no longer need.
org.springframework.security.web.savedrequest.DefaultSavedRequest(HttpServletRequest, PortResolver)
org.springframework.security.web.savedrequest.DefaultSavedRequest(HttpServletRequest, PortResolver, String)
org.springframework.security.web.savedrequest.DefaultSavedRequest.doesRequestMatch(HttpServletRequest, PortResolver)	This is deprecated for removal. Users can compare DefaultSavedRequest.getRedirectUrl() to the HttpServletRequest URL instead.
org.springframework.security.web.savedrequest.HttpSessionRequestCache.setPortResolver(PortResolver)
org.springframework.security.web.webauthn.management.JdbcUserCredentialRepository.setLobHandler(LobHandler)	LobHandler is deprecated without replacement, as such this method will also be removed without replacement

Deprecated Interfaces

Interface	Description
org.springframework.security.access.AccessDecisionManager	Use AuthorizationManager instead
org.springframework.security.access.AccessDecisionVoter	Use AuthorizationManager instead
org.springframework.security.access.AfterInvocationProvider	Use delegation with AuthorizationManager
org.springframework.security.access.annotation.AnnotationMetadataExtractor	Used only by now-deprecated classes. Consider SecuredAuthorizationManager for `@Secured` methods.
org.springframework.security.access.ConfigAttribute	In modern Spring Security APIs, each API manages its own configuration context. As such there is no direct replacement for this interface. In the case of method security, please see SecurityAnnotationScanner and AuthorizationManager. In the case of channel security, please see HttpsRedirectFilter. In the case of web security, please see AuthorizationManager.
org.springframework.security.access.intercept.AfterInvocationManager	Use delegation with AuthorizationManager
org.springframework.security.access.intercept.aspectj.AspectJCallback	This class will be removed from the public API. Please either use `spring-security-aspects`, Spring Security's method security support or create your own class that uses Spring AOP annotations.
org.springframework.security.access.intercept.RunAsManager	Authentication is now separated from authorization in Spring Security. This class is only used by now-deprecated components. There is not yet an equivalent replacement in Spring Security.
org.springframework.security.access.method.MethodSecurityMetadataSource	Use the use-authorization-manager attribute for <method-security> and <intercept-methods> instead or use annotation-based or AuthorizationManager-based authorization
org.springframework.security.access.prepost.PostInvocationAttribute	Use AuthorizationManagerAfterMethodInterceptor instead
org.springframework.security.access.prepost.PostInvocationAuthorizationAdvice	Use AuthorizationManagerAfterMethodInterceptor instead
org.springframework.security.access.prepost.PreInvocationAttribute	Use AuthorizationManagerBeforeMethodInterceptor instead
org.springframework.security.access.prepost.PreInvocationAuthorizationAdvice	Use AuthorizationManagerBeforeMethodInterceptor instead
org.springframework.security.access.prepost.PrePostInvocationAttributeFactory	Use delegation with AuthorizationManager
org.springframework.security.access.SecurityMetadataSource	In modern Spring Security APIs, each API manages its own configuration context. As such there is no direct replacement for this interface. In the case of method security, please see SecurityAnnotationScanner and AuthorizationManager. In the case of channel security, please see HttpsRedirectFilter. In the case of web security, please see AuthorizationManager.
org.springframework.security.messaging.access.intercept.MessageSecurityMetadataSource	Use MessageMatcherDelegatingAuthorizationManager instead
org.springframework.security.saml2.provider.service.authentication.Saml2AuthenticatedPrincipal	Please use Saml2AssertionAuthentication.getRelyingPartyRegistrationId() and Saml2ResponseAssertionAccessor instead
org.springframework.security.web.access.channel.ChannelDecisionManager	no replacement is planned, though consider using a custom RequestMatcher for any sophisticated decision-making
org.springframework.security.web.access.channel.ChannelEntryPoint	please use HttpsRedirectFilter and its associated PortMapper
org.springframework.security.web.access.channel.ChannelProcessor	no replacement is planned, though consider using a custom RequestMatcher for any sophisticated decision-making
org.springframework.security.web.access.intercept.FilterInvocationSecurityMetadataSource	In modern Spring Security APIs, each API manages its own configuration context. As such there is no direct replacement for this interface. In the case of method security, please see SecurityAnnotationScanner and AuthorizationManager. In the case of channel security, please see HttpsRedirectFilter. In the case of web security, please see AuthorizationManager.
org.springframework.security.web.header.writers.frameoptions.AllowFromStrategy	ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
org.springframework.security.web.PortResolver	This existed for an old IE bug and is no longer need.

Deprecated Classes

Class	Description
org.springframework.security.access.annotation.Jsr250MethodSecurityMetadataSource	Use Jsr250AuthorizationManager instead
org.springframework.security.access.annotation.Jsr250SecurityConfig	Use AuthorizationManagerBeforeMethodInterceptor.jsr250() instead
org.springframework.security.access.annotation.Jsr250Voter	Use Jsr250AuthorizationManager instead
org.springframework.security.access.annotation.SecuredAnnotationSecurityMetadataSource	Use AuthorizationManagerBeforeMethodInterceptor.secured()
org.springframework.security.access.event.AbstractAuthorizationEvent	Authorization events have moved. Consider AuthorizationGrantedEvent and AuthorizationDeniedEvent
org.springframework.security.access.event.AuthenticationCredentialsNotFoundEvent	Authentication is now separated from authorization. Consider AbstractAuthenticationFailureEvent instead.
org.springframework.security.access.event.AuthorizationFailureEvent	Use AuthorizationDeniedEvent instead
org.springframework.security.access.event.AuthorizedEvent	Use AuthorizationGrantedEvent instead
org.springframework.security.access.event.LoggerListener	Logging is now embedded in Spring Security components. If you need further logging, please consider using your own ApplicationListener
org.springframework.security.access.event.PublicInvocationEvent	Only used by now-deprecated classes. Consider EventObject.getSource() to deduce public invocations.
org.springframework.security.access.expression.method.ExpressionBasedAnnotationAttributeFactory	Use AuthorizationManager interceptors instead
org.springframework.security.access.expression.method.ExpressionBasedPostInvocationAdvice	Use AuthorizationManagerAfterMethodInterceptor instead
org.springframework.security.access.expression.method.ExpressionBasedPreInvocationAdvice	Use AuthorizationManagerAfterMethodInterceptor instead
org.springframework.security.access.intercept.AbstractSecurityInterceptor	Use AuthorizationFilter instead for filter security, AuthorizationChannelInterceptor for messaging security, or AuthorizationManagerBeforeMethodInterceptor and AuthorizationManagerAfterMethodInterceptor for method security.
org.springframework.security.access.intercept.AfterInvocationProviderManager	Use delegation with AuthorizationManager
org.springframework.security.access.intercept.aopalliance.MethodSecurityInterceptor	Please use AuthorizationManagerBeforeMethodInterceptor and AuthorizationManagerAfterMethodInterceptor instead
org.springframework.security.access.intercept.aopalliance.MethodSecurityMetadataSourceAdvisor	Use EnableMethodSecurity or publish interceptors directly
org.springframework.security.access.intercept.aspectj.AspectJMethodSecurityInterceptor	This class will be removed from the public API. Please either use `spring-security-aspects`, Spring Security's method security support or create your own class that uses Spring AOP annotations.
org.springframework.security.access.intercept.aspectj.MethodInvocationAdapter	This class will be removed from the public API. See `JoinPointMethodInvocation` in `spring-security-aspects` for its replacement
org.springframework.security.access.intercept.InterceptorStatusToken	Use delegation with AuthorizationManager
org.springframework.security.access.intercept.MethodInvocationPrivilegeEvaluator	Use AuthorizationManager instead
org.springframework.security.access.intercept.RunAsImplAuthenticationProvider	Authentication is now separated from authorization in Spring Security. This class is only used by now-deprecated components. There is not yet an equivalent replacement in Spring Security.
org.springframework.security.access.intercept.RunAsManagerImpl	Authentication is now separated from authorization in Spring Security. This class is only used by now-deprecated components. There is not yet an equivalent replacement in Spring Security.
org.springframework.security.access.intercept.RunAsUserToken	Authentication is now separated from authorization in Spring Security. This class is only used by now-deprecated components. There is not yet an equivalent replacement in Spring Security.
org.springframework.security.access.method.AbstractFallbackMethodSecurityMetadataSource	Use the use-authorization-manager attribute for <method-security> and <intercept-methods> instead or use annotation-based or AuthorizationManager-based authorization
org.springframework.security.access.method.AbstractMethodSecurityMetadataSource	Use the use-authorization-manager attribute for <method-security> and <intercept-methods> instead or use annotation-based or AuthorizationManager-based authorization
org.springframework.security.access.method.DelegatingMethodSecurityMetadataSource	Use the use-authorization-manager attribute for <method-security> and <intercept-methods> instead or use annotation-based or AuthorizationManager-based authorization
org.springframework.security.access.method.MapBasedMethodSecurityMetadataSource	Use the use-authorization-manager attribute for <method-security> and <intercept-methods> instead or use annotation-based or AuthorizationManager-based authorization
org.springframework.security.access.prepost.PostInvocationAdviceProvider	Use AuthorizationManagerAfterMethodInterceptor instead
org.springframework.security.access.prepost.PreInvocationAuthorizationAdviceVoter	Use AuthorizationManagerBeforeMethodInterceptor instead
org.springframework.security.access.prepost.PrePostAdviceReactiveMethodInterceptor	Use AuthorizationManagerBeforeReactiveMethodInterceptor or AuthorizationManagerAfterReactiveMethodInterceptor
org.springframework.security.access.prepost.PrePostAnnotationSecurityMetadataSource	Use PreAuthorizeAuthorizationManager and PostAuthorizeAuthorizationManager instead
org.springframework.security.access.SecurityConfig	In modern Spring Security APIs, each API manages its own configuration context. As such there is no direct replacement for this interface. In the case of method security, please see SecurityAnnotationScanner and AuthorizationManager. In the case of channel security, please see HttpsRedirectFilter. In the case of web security, please see AuthorizationManager.
org.springframework.security.access.vote.AbstractAccessDecisionManager	Use AuthorizationManager instead
org.springframework.security.access.vote.AbstractAclVoter	Now used by only-deprecated classes. Generally speaking, in-memory ACL is no longer advised, so no replacement is planned at this point.
org.springframework.security.access.vote.AffirmativeBased	Use AuthorizationManager instead
org.springframework.security.access.vote.AuthenticatedVoter	Use AuthorityAuthorizationManager instead
org.springframework.security.access.vote.ConsensusBased	Use AuthorizationManager instead
org.springframework.security.access.vote.RoleHierarchyVoter	Use AuthorityAuthorizationManager.setRoleHierarchy(org.springframework.security.access.hierarchicalroles.RoleHierarchy) instead
org.springframework.security.access.vote.RoleVoter	Use AuthorityAuthorizationManager instead
org.springframework.security.access.vote.UnanimousBased	Use AuthorizationManager instead
org.springframework.security.acls.AclEntryVoter	please use AclPermissionEvaluator instead. Spring Method Security annotations may also prove useful, for example @PreAuthorize("hasPermission(#id, ObjectsReturnType.class, read)")
org.springframework.security.acls.afterinvocation.AbstractAclProvider	please use AclPermissionEvaluator instead. Spring Method Security annotations may also prove useful, for example @PostAuthorize("hasPermission(filterObject, read)")
org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationCollectionFilteringProvider	please use AclPermissionEvaluator instead. Spring Method Security annotations may also prove useful, for example @PostFilter("hasPermission(filterObject, read)")
org.springframework.security.acls.afterinvocation.AclEntryAfterInvocationProvider	please use AclPermissionEvaluator instead. Spring Method Security annotations may also prove useful, for example @PostAuthorize("hasPermission(filterObject, read)")
org.springframework.security.config.annotation.method.configuration.GlobalMethodSecurityConfiguration	Use PrePostMethodSecurityConfiguration, SecuredMethodSecurityConfiguration, or Jsr250MethodSecurityConfiguration instead
org.springframework.security.config.annotation.web.configurers.AbstractConfigAttributeRequestMatcherRegistry	In modern Spring Security APIs, each API manages its own configuration context. As such there is no direct replacement for this interface. In the case of method security, please see SecurityAnnotationScanner and AuthorizationManager. In the case of channel security, please see HttpsRedirectFilter. In the case of web security, please see AuthorizationManager.
org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer	please use HttpsRedirectConfigurer instead
org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer.ChannelRequestMatcherRegistry	no replacement planned
org.springframework.security.config.annotation.web.configurers.ChannelSecurityConfigurer.RequiresChannelUrl	no replacement planned
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.HpkpConfig	see Certificate and Public Key Pinning for more context
org.springframework.security.config.annotation.web.servlet.configuration.WebMvcSecurityConfiguration	This is applied internally using SpringWebMvcImportSelector
org.springframework.security.config.http.ChannelAttributeFactory	In modern Spring Security APIs, each API manages its own configuration context. As such there is no direct replacement for this interface. In the case of method security, please see SecurityAnnotationScanner and AuthorizationManager. In the case of channel security, please see HttpsRedirectFilter. In the case of web security, please see AuthorizationManager.
org.springframework.security.config.http.FilterInvocationSecurityMetadataSourceParser	Use `use-authorization-manager` property instead
org.springframework.security.config.http.MessageMatcherFactoryBean
org.springframework.security.config.http.RequestMatcherFactoryBean
org.springframework.security.config.method.GlobalMethodSecurityBeanDefinitionParser	Use MethodSecurityBeanDefinitionParser instead
org.springframework.security.config.method.MethodSecurityMetadataSourceBeanDefinitionParser	Use <intercept-methods>, <method-security>, or @EnableMethodSecurity
org.springframework.security.crypto.password.LdapShaPasswordEncoder	Digest based password encoding is not considered secure. Instead use an adaptive one way function like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or SCryptPasswordEncoder. Even better use DelegatingPasswordEncoder which supports password upgrades. There are no plans to remove this support. It is deprecated to indicate that this is a legacy implementation and using it is considered insecure.
org.springframework.security.crypto.password.Md4PasswordEncoder	Digest based password encoding is not considered secure. Instead use an adaptive one way function like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or SCryptPasswordEncoder. Even better use DelegatingPasswordEncoder which supports password upgrades. There are no plans to remove this support. It is deprecated to indicate that this is a legacy implementation and using it is considered insecure.
org.springframework.security.crypto.password.MessageDigestPasswordEncoder	Digest based password encoding is not considered secure. Instead use an adaptive one way function like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or SCryptPasswordEncoder. Even better use DelegatingPasswordEncoder which supports password upgrades. There are no plans to remove this support. It is deprecated to indicate that this is a legacy implementation and using it is considered insecure.
org.springframework.security.crypto.password.NoOpPasswordEncoder	This PasswordEncoder is not secure. Instead use an adaptive one way function like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or SCryptPasswordEncoder. Even better use DelegatingPasswordEncoder which supports password upgrades. There are no plans to remove this support. It is deprecated to indicate that this is a legacy implementation and using it is considered insecure.
org.springframework.security.crypto.password.StandardPasswordEncoder	Digest based password encoding is not considered secure. Instead use an adaptive one way function like BCryptPasswordEncoder, Pbkdf2PasswordEncoder, or SCryptPasswordEncoder. Even better use DelegatingPasswordEncoder which supports password upgrades. There are no plans to remove this support. It is deprecated to indicate that this is a legacy implementation and using it is considered insecure.
org.springframework.security.messaging.access.expression.ExpressionBasedMessageSecurityMetadataSourceFactory	Use MessageMatcherDelegatingAuthorizationManager instead
org.springframework.security.messaging.access.expression.MessageExpressionVoter	Use MessageMatcherDelegatingAuthorizationManager instead
org.springframework.security.messaging.access.intercept.ChannelSecurityInterceptor	Use AuthorizationChannelInterceptor instead
org.springframework.security.messaging.access.intercept.DefaultMessageSecurityMetadataSource	Use MessageMatcherDelegatingAuthorizationManager instead
org.springframework.security.rsocket.authentication.BasicAuthenticationPayloadExchangeConverter	please use AuthenticationPayloadExchangeConverter instead
org.springframework.security.rsocket.authentication.BearerPayloadExchangeConverter	please use AuthenticationPayloadExchangeConverter instead
org.springframework.security.rsocket.metadata.BasicAuthenticationDecoder	Basic Authentication did not evolve into a standard. Use Simple Authentication instead.
org.springframework.security.rsocket.metadata.BasicAuthenticationEncoder	Basic Authentication did not evolve into a standard. use SimpleAuthenticationEncoder
org.springframework.security.saml2.provider.service.authentication.DefaultSaml2AuthenticatedPrincipal	Please use Saml2ResponseAssertionAccessor
org.springframework.security.saml2.provider.service.metadata.RequestMatcherMetadataResponseResolver	Please use RequestMatcherMetadataResponseResolver
org.springframework.security.web.access.channel.AbstractRetryEntryPoint	please use HttpsRedirectFilter and its associated PortMapper
org.springframework.security.web.access.channel.ChannelDecisionManagerImpl	no replacement is planned, though consider using a custom RequestMatcher for any sophisticated decision-making
org.springframework.security.web.access.channel.ChannelProcessingFilter	see HttpsRedirectFilter
org.springframework.security.web.access.channel.InsecureChannelProcessor	no replacement is planned, though consider using a custom RequestMatcher for any sophisticated decision-making
org.springframework.security.web.access.channel.RetryWithHttpEntryPoint	please use HttpsRedirectFilter and its associated PortMapper
org.springframework.security.web.access.channel.RetryWithHttpsEntryPoint	please use HttpsRedirectFilter and its associated PortMapper
org.springframework.security.web.access.channel.SecureChannelProcessor	no replacement is planned, though consider using a custom RequestMatcher for any sophisticated decision-making
org.springframework.security.web.access.DefaultWebInvocationPrivilegeEvaluator	Use AuthorizationManagerWebInvocationPrivilegeEvaluator instead
org.springframework.security.web.access.expression.ExpressionBasedFilterInvocationSecurityMetadataSource	In modern Spring Security APIs, each API manages its own configuration context. As such there is no direct replacement for this interface. In the case of method security, please see SecurityAnnotationScanner and AuthorizationManager. In the case of channel security, please see HttpsRedirectFilter. In the case of web security, please see AuthorizationManager.
org.springframework.security.web.access.expression.WebExpressionVoter	Use WebExpressionAuthorizationManager instead
org.springframework.security.web.access.intercept.DefaultFilterInvocationSecurityMetadataSource	In modern Spring Security APIs, each API manages its own configuration context. As such there is no direct replacement for this interface. In the case of method security, please see SecurityAnnotationScanner and AuthorizationManager. In the case of channel security, please see HttpsRedirectFilter. In the case of web security, please see AuthorizationManager.
org.springframework.security.web.access.intercept.FilterSecurityInterceptor	Use AuthorizationFilter instead
org.springframework.security.web.access.RequestMatcherDelegatingWebInvocationPrivilegeEvaluator	please use AuthorizationManagerWebInvocationPrivilegeEvaluator and adapt any delegate WebInvocationPrivilegeEvaluators into AuthorizationManagers
org.springframework.security.web.authentication.preauth.x509.SubjectDnX509PrincipalExtractor	Please use SubjectX500PrincipalExtractor instead
org.springframework.security.web.bind.support.AuthenticationPrincipalArgumentResolver	Use AuthenticationPrincipalArgumentResolver instead.
org.springframework.security.web.context.HttpRequestResponseHolder	Use SecurityContextRepository.loadDeferredContext(HttpServletRequest)
org.springframework.security.web.context.SaveContextOnUpdateOrErrorResponseWrapper	Use SecurityContextRepository.loadDeferredContext(HttpServletRequest) instead.
org.springframework.security.web.context.SecurityContextPersistenceFilter	Use SecurityContextHolderFilter
org.springframework.security.web.header.writers.frameoptions.AbstractRequestParameterAllowFromStrategy	ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
org.springframework.security.web.header.writers.frameoptions.RegExpAllowFromStrategy	ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
org.springframework.security.web.header.writers.frameoptions.StaticAllowFromStrategy	ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
org.springframework.security.web.header.writers.frameoptions.WhiteListedAllowFromStrategy	ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
org.springframework.security.web.header.writers.HpkpHeaderWriter	see Certificate and Public Key Pinning for more context
org.springframework.security.web.PortResolverImpl	This existed for an old IE bug and is no longer need.
org.springframework.security.web.server.ServerFormLoginAuthenticationConverter	use ServerFormLoginAuthenticationConverter instead.
org.springframework.security.web.server.ServerHttpBasicAuthenticationConverter	Use ServerHttpBasicAuthenticationConverter instead.

Deprecated Annotation Interfaces

Annotation Interface	Description
org.springframework.security.access.method.P	use @{code org.springframework.security.core.parameters.P}
org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity	Use EnableMethodSecurity instead
org.springframework.security.web.bind.annotation.AuthenticationPrincipal	Use AuthenticationPrincipal instead.

Deprecated Fields

Field	Description
org.springframework.security.core.SpringSecurityCoreVersion.SERIAL_VERSION_UID	Please have each class use its own serialization version
org.springframework.security.messaging.util.matcher.AbstractMessageMatcherComposite.LOGGER	since 5.4 in favor of AbstractMessageMatcherComposite.logger
org.springframework.security.oauth2.jwt.JoseHeaderNames.X5T	The SHA-1 algorithm has been proven to be vulnerable to collision attacks and should not be used. See the Google Security Blog for more info.
org.springframework.security.rsocket.metadata.BearerTokenMetadata.BEARER_AUTHENTICATION_MIME_TYPE	Basic did not evolve into the standard. Instead use Simple Authentication MimeTypeUtils.parseMimeType(WellKnownMimeType.MESSAGE_RSOCKET_AUTHENTICATION.getString())
org.springframework.security.rsocket.metadata.UsernamePasswordMetadata.BASIC_AUTHENTICATION_MIME_TYPE	Basic did not evolve into the standard. Instead use Simple Authentication MimeTypeUtils.parseMimeType(WellKnownMimeType.MESSAGE_RSOCKET_AUTHENTICATION.getString())

Deprecated Methods

Method	Description
org.springframework.security.access.hierarchicalroles.RoleHierarchyUtils.roleHierarchyFromMap(Map<String, List<String>>)	please see RoleHierarchyImpl#setHierarchy deprecation notice
org.springframework.security.authentication.DefaultAuthenticationEventPublisher.setAdditionalExceptionMappings(Properties)	use DefaultAuthenticationEventPublisher.setAdditionalExceptionMappings(Map)
org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory.addAdvisor(AuthorizationAdvisor)	please provide all advisors in the constructor
org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory.setAdvisors(Collection<AuthorizationAdvisor>)	Please use AuthorizationAdvisorProxyFactory.addAdvisor(org.springframework.security.authorization.method.AuthorizationAdvisor) instead
org.springframework.security.authorization.method.AuthorizationAdvisorProxyFactory.setAdvisors(AuthorizationAdvisor...)	Please use AuthorizationAdvisorProxyFactory.addAdvisor(org.springframework.security.authorization.method.AuthorizationAdvisor) instead
org.springframework.security.config.annotation.rsocket.RSocketSecurity.basicAuthentication(Customizer<RSocketSecurity.BasicAuthenticationSpec>)	Use RSocketSecurity.simpleAuthentication(Customizer)
org.springframework.security.config.annotation.web.builders.HttpSecurity.requiresChannel(Customizer<ChannelSecurityConfigurer.ChannelRequestMatcherRegistry>)	Use HttpSecurity.redirectToHttps(org.springframework.security.config.Customizer<org.springframework.security.config.annotation.web.configurers.HttpsRedirectConfigurer<org.springframework.security.config.annotation.web.builders.HttpSecurity>>)
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.featurePolicy(String)	For removal in 7.0. Use HeadersConfigurer.permissionsPolicy(Customizer) or permissionsPolicy(Customizer.withDefaults()) to stick with defaults. See the documentation for more details.
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.httpPublicKeyPinning(Customizer<HeadersConfigurer.HpkpConfig>)	see Certificate and Public Key Pinning for more context
org.springframework.security.config.annotation.web.configurers.HeadersConfigurer.permissionsPolicy(Customizer<HeadersConfigurer.PermissionsPolicyConfig>)	For removal in 7.0. Use HeadersConfigurer.permissionsPolicyHeader(Customizer) instead
org.springframework.security.config.annotation.web.configurers.ott.OneTimeTokenLoginConfigurer.authenticationFailureHandler(AuthenticationFailureHandler)	Use AbstractAuthenticationFilterConfigurer.failureHandler(AuthenticationFailureHandler) instead
org.springframework.security.config.annotation.web.configurers.ott.OneTimeTokenLoginConfigurer.authenticationSuccessHandler(AuthenticationSuccessHandler)	Use AbstractAuthenticationFilterConfigurer.successHandler(AuthenticationSuccessHandler) instead
org.springframework.security.config.annotation.web.configurers.ott.OneTimeTokenLoginConfigurer.getContext()	Use this.context instead
org.springframework.security.config.annotation.web.configurers.saml2.Saml2LoginConfigurer.authenticationRequestUri(String)	Use Saml2LoginConfigurer.authenticationRequestUriQuery(java.lang.String) instead
org.springframework.security.config.annotation.web.configurers.X509Configurer.subjectPrincipalRegex(String)	Please use {X509Configurer.x509PrincipalExtractor(X509PrincipalExtractor) instead
org.springframework.security.config.web.server.ServerHttpSecurity.HeaderSpec.featurePolicy(String)	For removal in 7.0. Use ServerHttpSecurity.HeaderSpec.permissionsPolicy(Customizer) instead.
org.springframework.security.config.web.server.ServerHttpSecurity.HeaderSpec.FeaturePolicySpec.and()	For removal in 7.0. Use #featurePolicy(Customizer) instead
org.springframework.security.core.userdetails.User.withDefaultPasswordEncoder()	Using this method is not considered safe for production, but is acceptable for demos and getting started. For production purposes, ensure the password is encoded externally. See the method Javadoc for additional details. There are no plans to remove this support. It is deprecated to indicate that this is considered insecure for production purposes.
org.springframework.security.crypto.argon2.Argon2PasswordEncoder.defaultsForSpringSecurity_v5_2()	Use Argon2PasswordEncoder.defaultsForSpringSecurity_v5_8() instead
org.springframework.security.crypto.password.Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_5()	Use Pbkdf2PasswordEncoder.defaultsForSpringSecurity_v5_8() instead
org.springframework.security.crypto.scrypt.SCryptPasswordEncoder.defaultsForSpringSecurity_v4_1()	Use SCryptPasswordEncoder.defaultsForSpringSecurity_v5_8() instead
org.springframework.security.oauth2.client.oidc.userinfo.OidcReactiveOAuth2UserService.setOidcUserMapper(BiFunction<OidcUserRequest, OidcUserInfo, Mono<OidcUser>>)	Use OidcReactiveOAuth2UserService.setOidcUserConverter(Converter) instead
org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService.setAccessibleScopes(Set<String>)	Use OidcUserService.setRetrieveUserInfo(Predicate) instead
org.springframework.security.oauth2.client.oidc.userinfo.OidcUserService.setOidcUserMapper(BiFunction<OidcUserRequest, OidcUserInfo, OidcUser>)	Use OidcUserService.setOidcUserConverter(Converter) instead
org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter.setAuthenticationDetailsSource(AuthenticationDetailsSource<HttpServletRequest, ?>)	Please provide an AuthenticationConverter in the constructor and set the AuthenticationDetailsSource there instead. For example, you can use BearerTokenAuthenticationConverter.setAuthenticationDetailsSource(org.springframework.security.authentication.AuthenticationDetailsSource<jakarta.servlet.http.HttpServletRequest, ?>)
org.springframework.security.oauth2.server.resource.web.authentication.BearerTokenAuthenticationFilter.setBearerTokenResolver(BearerTokenResolver)	Please provide an AuthenticationConverter in the constructor instead
org.springframework.security.web.access.channel.AbstractRetryEntryPoint.getPortResolver()
org.springframework.security.web.access.channel.AbstractRetryEntryPoint.setPortResolver(PortResolver)
org.springframework.security.web.access.expression.WebExpressionAuthorizationManager.setExpressionHandler(SecurityExpressionHandler<RequestAuthorizationContext>)	Please use WebExpressionAuthorizationManager.withDefaults() or WebExpressionAuthorizationManager.withExpressionHandler(org.springframework.security.access.expression.SecurityExpressionHandler<org.springframework.security.web.access.intercept.RequestAuthorizationContext>)
org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint.getPortResolver()
org.springframework.security.web.authentication.LoginUrlAuthenticationEntryPoint.setPortResolver(PortResolver)
org.springframework.security.web.context.DelegatingSecurityContextRepository.loadContext(HttpRequestResponseHolder)
org.springframework.security.web.context.HttpSessionSecurityContextRepository.loadContext(HttpRequestResponseHolder)	please see SecurityContextRepository.loadContext(org.springframework.security.web.context.HttpRequestResponseHolder)
org.springframework.security.web.context.NullSecurityContextRepository.loadContext(HttpRequestResponseHolder)	please see SecurityContextRepository.loadContext(org.springframework.security.web.context.HttpRequestResponseHolder)
org.springframework.security.web.context.RequestAttributeSecurityContextRepository.loadContext(HttpRequestResponseHolder)	please see SecurityContextRepository.loadContext(org.springframework.security.web.context.HttpRequestResponseHolder)
org.springframework.security.web.context.SecurityContextRepository.loadContext(HttpRequestResponseHolder)	Use SecurityContextRepository.loadDeferredContext(HttpServletRequest) instead.
org.springframework.security.web.firewall.StrictHttpFirewall.getEncodedUrlBlacklist()	Use StrictHttpFirewall.getEncodedUrlBlocklist() instead
org.springframework.security.web.savedrequest.DefaultSavedRequest.doesRequestMatch(HttpServletRequest, PortResolver)	This is deprecated for removal. Users can compare DefaultSavedRequest.getRedirectUrl() to the HttpServletRequest URL instead.
org.springframework.security.web.savedrequest.HttpSessionRequestCache.setPortResolver(PortResolver)
org.springframework.security.web.server.authentication.AuthenticationWebFilter.setAuthenticationConverter(Function<ServerWebExchange, Mono<Authentication>>)	As of 5.1 in favor of AuthenticationWebFilter.setServerAuthenticationConverter(ServerAuthenticationConverter)
org.springframework.security.web.server.ServerFormLoginAuthenticationConverter.apply(ServerWebExchange)
org.springframework.security.web.server.ServerHttpBasicAuthenticationConverter.apply(ServerWebExchange)
org.springframework.security.web.session.ConcurrentSessionFilter.determineExpiredUrl(HttpServletRequest, SessionInformation)	Use ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy) instead.
org.springframework.security.web.session.ConcurrentSessionFilter.setRedirectStrategy(RedirectStrategy)	use ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy) instead.
org.springframework.security.web.webauthn.management.JdbcUserCredentialRepository.setLobHandler(LobHandler)	LobHandler is deprecated without replacement, as such this method will also be removed without replacement

Deprecated Constructors

Constructor	Description
org.springframework.security.crypto.password.Pbkdf2PasswordEncoder(CharSequence, int, int, int)	Use Pbkdf2PasswordEncoder(CharSequence, int, int, SecretKeyFactoryAlgorithm) instead
org.springframework.security.oauth2.server.resource.introspection.SpringOpaqueTokenIntrospector(String, String, String)	Please use SpringOpaqueTokenIntrospector.Builder
org.springframework.security.oauth2.server.resource.introspection.SpringReactiveOpaqueTokenIntrospector(String, String, String)	Please use SpringReactiveOpaqueTokenIntrospector.Builder
org.springframework.security.saml2.provider.service.authentication.AbstractSaml2AuthenticationRequest.Builder()	Use Builder(RelyingPartyRegistration) instead
org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter(AllowFromStrategy)	ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.
org.springframework.security.web.savedrequest.DefaultSavedRequest(HttpServletRequest, PortResolver)
org.springframework.security.web.savedrequest.DefaultSavedRequest(HttpServletRequest, PortResolver, String)
org.springframework.security.web.session.ConcurrentSessionFilter(SessionRegistry, String)	use ConcurrentSessionFilter(SessionRegistry, SessionInformationExpiredStrategy) with SimpleRedirectSessionInformationExpiredStrategy instead.

Deprecated Enum Constants

Enum Constant	Description
org.springframework.security.config.annotation.rsocket.PayloadInterceptorOrder.BASIC_AUTHENTICATION	please see PayloadInterceptorOrder.AUTHENTICATION
org.springframework.security.config.annotation.rsocket.PayloadInterceptorOrder.JWT_AUTHENTICATION	please see PayloadInterceptorOrder.AUTHENTICATION
org.springframework.security.web.header.writers.frameoptions.XFrameOptionsHeaderWriter.XFrameOptionsMode.ALLOW_FROM	ALLOW-FROM is an obsolete directive that no longer works in modern browsers. Instead use Content-Security-Policy with the frame-ancestors directive.