spring-projects / spring-projects/spring-security
Consolidate logic for merging authorities
Open
@jzheaux is already working on this.
Since Oct 15, 2025.
in: core
type: enhancement
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Related to #18021 and https://github.com/spring-projects/spring-security/issues/17987, it would be nice if Authentication.Builder could merge authorities on its own. One way to do this is to add an authentication method to the builder, which would by default merge authorities from the given authentication into the current builder instance.
This will consolidate the logic currently residing in a half-dozen filters that are currently performing this authority-merging logic.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Assessment
This issue has not been assessed yet.