spring-projects/spring-security

View on GitHub

Spring Security

Stars: 9.6k
Forks: 6.3k
Open beginner issues: 14
Indexed issues: 1.3k
Avg merge: 2d 11h
Merged PRs (30d): 52

Dominant language: Java
License: Apache-2.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

1,277 open issues indexed

`RefreshTokenOAuth2AuthorizedClientProvider` initialization slows down application startup Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19406 · Opened Jul 1, 2026
OidcSessionRegistry nullability issues Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19403 · Opened Jun 30, 2026
ClassCastException with @PreAuthorize and @Cacheable on Kotlin suspend method Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19400 · Opened Jun 29, 2026
Allow OAuth2 Authorization Server to provide JWT scope claim aligned with OAuth2 Spec (space delimited) Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19392 · 1 comment · Opened Jun 26, 2026
Error on Spring Authorization server when issuing Id token after migrating from Spring boot 4.0.5 -> 4.0.7 Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19371 · 1 comment · 2 reactions · Opened Jun 23, 2026
InetOrgPerson uid should not be a mandatory field - may cause regression as of version 7.1.0 Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

spring-projects/spring-security#19370 · 1 comment · 1 reaction · Opened Jun 23, 2026
NullPointerException during WebAuthn registration when authenticator transport is unknown (e.g. "cable") Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 64/100

spring-projects/spring-security#19366 · Opened Jun 22, 2026
Update to OpenSAML 5.2 Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#19349 · Opened Jun 18, 2026
with `spring-security-oatuh2-jose-7.1.0` a `jwt` with `loa` value `null` always returns an error Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#19346 · 1 comment · 1 reaction · Opened Jun 17, 2026
OidcProviderConfigurationEndpointFilter (multi-issuer) only matches the path-append discovery location, not path-insertion — asymmetric with OAuth2AuthorizationServerMetadataEndpointFilter and breaks MCP discovery priority #2 Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

spring-projects/spring-security#19342 · 1 comment · Opened Jun 14, 2026
InMemoryReactiveSessionRegistry can lose a session under concurrent save/remove Open

status: waiting-for-triage

Difficulty 3/5 1-2 days Newbie friendliness 68/100

spring-projects/spring-security#19338 · Opened Jun 14, 2026
DefaultAuthorizationManagerFactory.anonymous() applies additionalAuthorization Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#19334 · Opened Jun 14, 2026
JwtAuthenticationToken.principal and JwtAuthenticationToken.Builder.principal types do not match Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19333 · Opened Jun 14, 2026
Pass BearerTokenAuthenticationToken#details to JwtAuthenticationConverter in addition to the JWT Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

spring-projects/spring-security#19328 · Opened Jun 12, 2026
Dependency regression: cas-client-core 4.1.x in Spring Security 7.1.0 breaks Java 17 baseline compatibility Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

spring-projects/spring-security#19325 · 2 reactions · Opened Jun 12, 2026
Ability to use AbstractAuthenticationFilterConfigurer for custom filters Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 55/100

spring-projects/spring-security#19319 · 2 comments · Opened Jun 11, 2026
Fix parametersConverters nullability in AbstractRestClientOAuth2AccessTokenResponseClient Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spring-projects/spring-security#19318 · Opened Jun 10, 2026
NimbusJwtEncoder should select only private keys for signing JWTs Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19311 · Opened Jun 9, 2026
`DelegatingAuthenticationFailureHandler` leaks implementation details in constructor Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19305 · Opened Jun 9, 2026
`AbstractConfiguredSecurityBuilder.getSharedObject` should be marked `@Nullable` Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19304 · Opened Jun 9, 2026
@PostFilter throws an IllegalArgumentException on null return after migrating to @EnableMethodSecurity Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 58/100

spring-projects/spring-security#19280 · Opened Jun 7, 2026
[BOUNTY CLAIM] Add setPreAuthenticationChecks #19275 Open

status: waiting-for-triage

Difficulty 4/5 3-5 days Newbie friendliness 20/100

spring-projects/spring-security#19279 · Opened Jun 7, 2026
Add setPreAuthenticationChecks to AbstractUserDetailsReactiveAuthenticationManager Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spring-projects/spring-security#19275 · Opened Jun 6, 2026
Authorization documentation uses deprecated setRoleHierarchy method Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 68/100

spring-projects/spring-security#19270 · 1 comment · Opened Jun 4, 2026
Introducing new PasswordHasher interface alongside PasswordEncoder Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

spring-projects/spring-security#19261 · Opened Jun 3, 2026
Freemarker JspTagLibs support breaks under EE11 Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

spring-projects/spring-security#19260 · 1 comment · Opened Jun 3, 2026
ScopedValue-based implementation of SecurityContextHolderStrategy Open

status: waiting-for-triage

Difficulty 5/5 Over a week Newbie friendliness 30/100

spring-projects/spring-security#19259 · 9 comments · Opened Jun 2, 2026
Improve OAuth2 Device Authorization consent handling for missing scopes Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 38/100

spring-projects/spring-security#19256 · 1 comment · Opened Jun 2, 2026
RegexRequestMatcher.matches() allocates LogMessage wrapper on every request even when debug disabled Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#19251 · 1 comment · Opened Jun 1, 2026
Kotlin DSL loginPage usage Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 70/100

spring-projects/spring-security#19249 · 1 comment · Opened Jun 1, 2026
Courtesy notice: unofficial MCP server for Spring Security documentation Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

spring-projects/spring-security#19248 · Opened Jun 1, 2026
OAuth2ClientJacksonModule is missing allowIfSubType for URL and Instant Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 58/100

spring-projects/spring-security#19241 · 2 comments · Opened May 30, 2026
OAuth2 Device Code Flow requires to be used with a requested scope Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 68/100

spring-projects/spring-security#19238 · 3 comments · Opened May 29, 2026
ClassCastException (HTTP 500) on /oauth2/token when single-value parameters are duplicated Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

spring-projects/spring-security#19227 · Opened May 27, 2026
Custom Jackson deserializers re-introspect nested types on every call — allocation hotspot in `JdbcOAuth2AuthorizationService` and Spring Session JDBC paths (much amplified by Jackson 3) Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

spring-projects/spring-security#19223 · Opened May 26, 2026
Need to be able to customize auto-approved scopes in Authorization server Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19222 · Opened May 26, 2026
Allow customization of OIDC sid creation from SessionInformation Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19221 · Opened May 26, 2026
"setAttribute is not supported" error from PathPatternRequestMatcher in child context with Spring Security 6.5.7 Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19219 · 3 comments · Opened May 25, 2026
Invalidate Spring session when user leaves consent screen in Spring authorization server Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19216 · Opened May 25, 2026
Couldn't find FilterChainProxy when using JDK Proxy Beans, but works with CGLIB Proxy Beans Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 52/100

spring-projects/spring-security#19207 · 5 comments · Opened May 23, 2026
InvalidOneTimeTokenException does not have a Jackson Mixin Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 52/100

spring-projects/spring-security#19203 · Opened May 22, 2026
Missing sid- and auth_time-claims in ID-token in case of WebAuthn Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 58/100

spring-projects/spring-security#19202 · 1 comment · Opened May 21, 2026
Fix for issue 18282 breaks remember-me feature Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 52/100

spring-projects/spring-security#19198 · Opened May 20, 2026
Enable Client Registration (OAuth2 or OIDC) with Opaque token or authenticationManagerResolver configured will catch error Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19186 · Opened May 15, 2026
Support SPC BBK (Secure Payment Confirmation with Browser Bound Keys) - Spring Security webauthn Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 30/100

spring-projects/spring-security#19178 · Opened May 14, 2026
Spring @Transactional Annotation in MODE.AspectJ does not work anymore after adding spring-security-aspects Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19177 · Opened May 14, 2026
Add support for reactive claim set converter in `NimbusReactiveJwtDecoder` Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19158 · 1 comment · Opened May 7, 2026
OidcClientInitiatedLogoutSuccessHandler generates incorrection logout URL when behind gateway/proxy Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19155 · Opened May 5, 2026
Mark matchingRequestParameterName as @Nullable in HttpSessionRequestCache and WebSessionServerRequestCache Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 85/100

spring-projects/spring-security#19153 · 1 reaction · Opened May 5, 2026
Consider catching WebClientException in HaveIBeenPwndApiReactivePasswordChecker Open

in: web type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#19142 · 1 comment · Opened May 1, 2026

spring-projects/spring-security

Get new issues in your inbox