Spring Security 6.0 中的新增功能

柔情只为你懂 2023-09-25 13:21 6阅读 0赞

Spring Security 6.0 提供了许多新功能。 以下是该版本的亮点。

### 基线更改 ###

*  Spring Security 6 需要 JDK 17

### 重大变更 ###

*  [gh-8980][]\- 删除不安全/已弃用。 而是使用数据存储来加密值。`Encryptors.querableText(CharSequence,CharSequence)`
 *  [gh-11520][]\- 记住我默认使用 SHA256
 *  [GH-8819][]\- 将过滤器移动到 Web 包 重新组织导入
 *  [gh-7349][]\- 将过滤器和令牌移动到适当的包 重新组织导入
 *  [gh-11026][]\- 使用代替`RequestAttributeSecurityContextRepository``NullSecurityContextRepository`
 *  [gh-11827][]\- 更改默认权限`oauth2Login()`
 *  [GH-10347][]\- 删除签入`UsernamePasswordAuthenticationToken``BasicAuthenticationFilter`
 *  [GH-11923][]\- 删除。 相反，创建一个[SecurityFilterChain bean][]。`WebSecurityConfigurerAdapter`
 *  [gh-11899][]\- 如果存在 Spring MVC，则默认使用。 您可以使用[<http> 中的请求匹配器属性][http_]配置差异。`MvcRequestMatcher``RequestMatcher`
 *  将使用授权管理器=“true”更改为默认值 如果应用程序分别使用或切换 toor。 如果应用程序依赖于隐式，则这不再是隐式的，需要指定。 或使用`use-expressions="true"``access-decision-manager-ref``use-expressions="false"``authorization-manager-ref``<intercept-url pattern="/**" access="permitAll"/>``use-authorization-manager="false"`
 *  [gh-11939][]\- 从 Java 配置中删除不推荐使用的帮助程序方法。 相反，使用者。`antMatchers``mvcMatchers``regexMatchers``requestMatchers``HttpSecurity#securityMatchers`
 *  [gh-11985][]\- 删除已弃用的构造函数，和。`Argon2PasswordEncoder``SCryptPasswordEncoder``Pbkdf2PasswordEncoder`
 *  [gh-11960][]\- 默认为[Servlet][]和[反应式][Link 1]的 Xor CSRF 保护
 *  [gh-12019][]\- 从中删除已弃用的方法`setTokenFromMultipartDataEnabled``CsrfWebFilter`
 *  [gh-12020][]\- 从 Java 配置中删除不推荐使用的方法`tokenFromMultipartDataEnabled`
 *  [gh-9429-][]重新抛出“身份验证服务异常”`Authentication(Web)Filter`
 *  gh-11027，[gh-11466-][] 对每种调度程序类型的授权
 *  [gh-11110][]\- 默认情况下需要显式会话保存
 *  [GH-11057][]\- 从中删除`MessageSourceAware``ExceptionTranslationWebFilter`
 *  [gh-12202][]\- 删除 OAuth 弃用
 *  [gh-10556][]\- 删除 EOL OpenSaml 3 支持。 请改用 OpenSaml 4 支持。
 *  [gh-11077][]\- 删除 SAML 弃用
    
     *  从和 中删除构造函数`Converter``Saml2MetadataFilter``Saml2AuthenticationTokenConverter`
     *  删除和实现`Saml2AuthenticationRequestContextResolver``Saml2AuthenticationRequestFactory`
     *  删除`Saml2AuthenticationToken(String, String, String, String, List)`
     *  删除和相关方法`RelyingPartyRegistration.ProviderDetails`
     *  删除`OpenSamlAuthenticationProvider`
 *  [gh-12180][]\- 注册所有调度程序类型`FilterChainProxy`

### 核心 ###

*  [gh-11446][]\- 添加本机映像支持`@PreAuthorize`
 *  [gh-11737][]\- 添加本机映像支持`@PostAuthorize`
 *  的[仪器][Link 2]，和`AuthenticationManager``AuthorizationManager``FilterChainProxy`
 *  的[仪器][Link 3]，和`ReactiveAuthenticationManager``ReactiveAuthorizationManager``WebFilterChainProxy`

### 目录 ###

*  [gh-9276][]\- LdapAuthority填充器经过后处理

### 蹼 ###

*  [GH-11432-][]支持迈克`CookieServerCsrfTokenRepository`

[gh-8980]: https://github.com/spring-projects/spring-security/issues/8980
[gh-11520]: https://github.com/spring-projects/spring-security/issues/11520
[GH-8819]: https://github.com/spring-projects/spring-security/issues/8819
[gh-7349]: https://github.com/spring-projects/spring-security/issues/7349
[gh-11026]: https://github.com/spring-projects/spring-security/issues/11026
[gh-11827]: https://github.com/spring-projects/spring-security/pull/11887
[GH-10347]: https://github.com/spring-projects/spring-security/issues/10347
[GH-11923]: https://github.com/spring-projects/spring-security/pull/11923
[SecurityFilterChain bean]: https://spring.io/blog/2022/02/21/spring-security-without-the-websecurityconfigureradapter
[gh-11899]: https://github.com/spring-projects/spring-security/issues/11899
[http_]: https://docs.spring.io/spring-security/reference/servlet/appendix/namespace/http.html#nsa-http-attributes
[gh-11939]: https://github.com/spring-projects/spring-security/issues/11939
[gh-11985]: https://github.com/spring-projects/spring-security/issues/11985
[gh-11960]: https://github.com/spring-projects/spring-security/issues/11960
[Servlet]: https://docs.spring.io/spring-security/reference/servlet/exploits/csrf.html#servlet-csrf-configure-request-handler
[Link 1]: https://docs.spring.io/spring-security/reference/reactive/exploits/csrf.html#webflux-csrf-configure-request-handler
[gh-12019]: https://github.com/spring-projects/spring-security/issues/12019
[gh-12020]: https://github.com/spring-projects/spring-security/issues/12020
[gh-9429-]: https://github.com/spring-projects/spring-security/issues/9429
[gh-11466-]: https://github.com/spring-projects/spring-security/issues/11466
[gh-11110]: https://github.com/spring-projects/spring-security/issues/11110
[GH-11057]: https://github.com/spring-projects/spring-security/issues/11057
[gh-12202]: https://github.com/spring-projects/spring-security/issues/12022
[gh-10556]: https://github.com/spring-projects/spring-security/issues/10556
[gh-11077]: https://github.com/spring-projects/spring-security/issues/11077
[gh-12180]: https://github.com/spring-projects/spring-security/issues/12180
[gh-11446]: https://github.com/spring-projects/spring-security/issues/11446
[gh-11737]: https://github.com/spring-projects/spring-security/issues/11737
[Link 2]: https://docs.spring.io/spring-security/reference/servlet/integrations/observability.html
[Link 3]: https://docs.spring.io/spring-security/reference/reactive/integrations/observability.html
[gh-9276]: https://github.com/spring-projects/spring-security/pull/9276
[GH-11432-]: https://github.com/spring-projects/spring-security/issues/11432