spring-projects/spring-security

View on GitHub

Spring Security

Stars: 9.6k
Forks: 6.3k
Open beginner issues: 14
Indexed issues: 1.3k
Avg merge: 2d 11h
Merged PRs (30d): 52

Dominant language: Java
License: Apache-2.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

48 beginner-friendly issues open

IpInetAddressMatcher throws ArrayIndexOutOfBoundsException instead of returning false for mismatched IPv4/IPv6 families Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

spring-projects/spring-security#19733 · Opened Sep 16, 2026
[doc issue] filter ordering Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19730 · Opened Sep 15, 2026
(doc issue) permitAll/denyAll listed as "methods" in docs but are actually fields in SecurityExpressionRoot Open

status: waiting-for-triage type: bug

Difficulty 1/5 Under an hour Newbie friendliness 90/100

spring-projects/spring-security#19728 · Opened Sep 15, 2026
XML configuration tests fail with a non-English locale Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#19725 · Opened Sep 15, 2026
Dependabot auto-merge should not apply to minor release updates Open

in: build type: task

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19717 · Opened Sep 14, 2026
Spring security becomes unusable when OpenSAML is on the module path Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

spring-projects/spring-security#19628 · Opened Aug 29, 2026
Make RegisteredClient.Builder methods @Nullable for @Nullable properties Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19597 · 1 comment · Opened Aug 25, 2026
InitializeUserDetailsBeanManagerConfigurer warning names wrong logger (inner class vs. suggested outer class) Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19595 · 1 comment · Opened Aug 25, 2026
TokenBasedRememberMeServices::onLoginSuccess can throw a NPE when UserDetailsService::loadUserByUsername returns null. Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19535 · 2 comments · Opened Aug 12, 2026
Confusion at 'A Review of Filters' Section in the Spring Security/Servlet Applications/ Architecture. Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#19522 · Opened Aug 11, 2026
DefaultBearerTokenResolver rejects RFC-legal multi-space `Authorization` header Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spring-projects/spring-security#19500 · 1 comment · Opened Aug 6, 2026
`TokenExchangeGrantRequest` sends an `OidcIdToken` subject token as `...:access_token` Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spring-projects/spring-security#19448 · 2 comments · Opened Jul 15, 2026
OidcSessionRegistry nullability issues Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19403 · Opened Jun 30, 2026
InetOrgPerson uid should not be a mandatory field - may cause regression as of version 7.1.0 Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

spring-projects/spring-security#19370 · 1 comment · 1 reaction · Opened Jun 23, 2026
Update to OpenSAML 5.2 Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#19349 · Opened Jun 18, 2026
with `spring-security-oatuh2-jose-7.1.0` a `jwt` with `loa` value `null` always returns an error Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#19346 · 1 comment · 1 reaction · Opened Jun 17, 2026
DefaultAuthorizationManagerFactory.anonymous() applies additionalAuthorization Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#19334 · Opened Jun 14, 2026
Fix parametersConverters nullability in AbstractRestClientOAuth2AccessTokenResponseClient Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spring-projects/spring-security#19318 · Opened Jun 10, 2026
NimbusJwtEncoder should select only private keys for signing JWTs Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19311 · Opened Jun 9, 2026
`DelegatingAuthenticationFailureHandler` leaks implementation details in constructor Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19305 · Opened Jun 9, 2026
`AbstractConfiguredSecurityBuilder.getSharedObject` should be marked `@Nullable` Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19304 · Opened Jun 9, 2026
Add setPreAuthenticationChecks to AbstractUserDetailsReactiveAuthenticationManager Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spring-projects/spring-security#19275 · Opened Jun 6, 2026
RegexRequestMatcher.matches() allocates LogMessage wrapper on every request even when debug disabled Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#19251 · 1 comment · Opened Jun 1, 2026
Mark matchingRequestParameterName as @Nullable in HttpSessionRequestCache and WebSessionServerRequestCache Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

spring-projects/spring-security#19153 · 1 reaction · Opened May 5, 2026
Consider catching WebClientException in HaveIBeenPwndApiReactivePasswordChecker Open

in: web type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#19142 · 1 comment · Opened May 1, 2026
Javadoc for HttpSecurity.cors(Customizer<CorsConfigurer<HttpSecurity>>) gives the impression that CORS is opt-in but that's no longer the case Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19139 · Opened Apr 30, 2026
Document Timing Attack Mitigation Support Open

in: docs type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19082 · 2 comments · Opened Apr 15, 2026
Logging in via oauth2 using redis session throws jackson error Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

spring-projects/spring-security#19077 · 2 comments · Opened Apr 15, 2026
`InetAddressMatchers.matchExternal()` matches `null` and `0.0.0.0` Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#19072 · Opened Apr 14, 2026
Add a link to the beginner-friendly code example for storing authentication manually Open

status: waiting-for-triage type: enhancement

Difficulty 1/5 Under an hour Newbie friendliness 78/100

spring-projects/spring-security#18899 · 1 comment · Opened Mar 16, 2026
Lazily instantiate default components in WebAuthnConfigurer Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#18585 · 1 comment · 4 reactions · Opened Jan 25, 2026
Document behavior when multiple CorsConfigurationSource beans are present Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#18583 · 1 comment · Opened Jan 25, 2026
Add Support for customizing restOperations on OidcBackChannelLogoutHandler Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#18252 · 1 comment · 1 reaction · Opened Dec 2, 2025
WebAuthnAuthenticationProvider does not pass UserDetails to WebAuthnAuthentication Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#18105 · Opened Oct 27, 2025
Kotlin security configuration examples call `AuthorizeHttpRequestsDsl::authorize` with an array of patterns, but this signature doesn't exist Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#17174 · 1 comment · 6 reactions · Opened May 27, 2025
Document Upgrading Password Encoding Open

in: docs status: ideal-for-contribution type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

spring-projects/spring-security#17112 · 2 comments · Opened May 14, 2025
Duplicate section in OAuth-2.0-Migration-Guide Wiki Open

status: waiting-for-triage type: bug

Difficulty 1/5 Under an hour Newbie friendliness 68/100

spring-projects/spring-security#16720 · Opened Mar 11, 2025
Wrong import for NonNull in DefaultSecurityFilterChain Open

status: waiting-for-triage type: enhancement

Difficulty 1/5 Under an hour Newbie friendliness 68/100

spring-projects/spring-security#16572 · Opened Feb 11, 2025
Wrong class referenced in Spring Security documentation Open

status: waiting-for-triage type: enhancement

Difficulty 1/5 Under an hour Newbie friendliness 65/100

spring-projects/spring-security#15541 · 1 comment · Opened Aug 8, 2024
Improve javadoc for User's withDefaultPasswordEncoder method to include Spring Boot CLI as an alternative too Open

status: waiting-for-triage type: enhancement

Difficulty 1/5 Under an hour Newbie friendliness 62/100

spring-projects/spring-security#13607 · Opened Aug 1, 2023
Document that generally not good to set eraseCredentials to false Open

in: docs type: enhancement

Difficulty 1/5 Under an hour Newbie friendliness 62/100

spring-projects/spring-security#12631 · Opened Feb 3, 2023
Copy-paste error in documentation. Open

status: waiting-for-triage type: bug

Difficulty 1/5 Under an hour Newbie friendliness 65/100

spring-projects/spring-security#12600 · Opened Jan 30, 2023
[Documentation] Update resource server docs about valdiation of JWT 'aud' claim Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

spring-projects/spring-security#11616 · Opened Jul 24, 2022
AbstractAuthenticationFilterConfigurer failureUrl Javadoc is incorrect Open

in: docs type: bug

Difficulty 1/5 Under an hour Newbie friendliness 68/100

spring-projects/spring-security#9229 · 1 comment · Opened Dec 2, 2020
resolvePermission in AclPermissionEvaluator could support String[] and Integer[] permissions Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#6027 · Opened Oct 28, 2018
Minor improvement for JdbcTokenRepositoryImpl Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 62/100

spring-projects/spring-security#4931 · Opened Dec 28, 2017
Incorrect use of ticketCache in spring-security-cas causes tickets to live forever Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 62/100

spring-projects/spring-security#4146 · 1 reaction · Opened Dec 6, 2016
SEC-2176: PersistentRememberMeToken not Serializable. Incompatible with Spring HttpInvoker. Open

in: web type: bug type: jira

Difficulty 1/5 Under an hour Newbie friendliness 68/100

spring-projects/spring-security#2403 · 1 comment · Opened Jun 8, 2013

spring-projects/spring-security

Get new issues in your inbox