spring-projects/spring-security

View on GitHub

Spring Security

Stars: 9.6k
Forks: 6.3k
Open beginner issues: 14
Indexed issues: 1.3k
Avg merge: 2d 11h
Merged PRs (30d): 52

Dominant language: Java
License: Apache-2.0
Last GitHub push: Sep 18, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

1,277 issues indexed so far

Client authentication errors cannot be serialised differently without reimplementing onAuthenticationFailure Open

status: waiting-for-triage

Difficulty 3/5 1-2 days Newbie friendliness 74/100

spring-projects/spring-security#19742 · Opened Sep 16, 2026
Token endpoint: a converter that declines gets the same answer as an unknown grant type Open

status: waiting-for-triage

Difficulty 5/5 Over a week Newbie friendliness 38/100

spring-projects/spring-security#19741 · Opened Sep 16, 2026
Update to Micrometer 1.18.0-M2 Open

type: dependency-upgrade

spring-projects/spring-security#19739 · 1 assignee · Opened Sep 16, 2026
Update to Spring LDAP 4.2.0-M1 Open

type: dependency-upgrade

spring-projects/spring-security#19738 · 1 assignee · Opened Sep 16, 2026
Update to Reactor 2026.0.0-M2 Open

type: dependency-upgrade

spring-projects/spring-security#19737 · 1 assignee · Opened Sep 16, 2026
Update to Spring Data 2026.1.0-M2 Open

type: dependency-upgrade

spring-projects/spring-security#19736 · 1 assignee · Opened Sep 16, 2026
Update to Spring Framework 7.1.0-M2 Open

type: dependency-upgrade

spring-projects/spring-security#19735 · 1 assignee · Opened Sep 16, 2026
IpInetAddressMatcher throws ArrayIndexOutOfBoundsException instead of returning false for mismatched IPv4/IPv6 families Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 88/100

spring-projects/spring-security#19733 · Opened Sep 16, 2026
[doc issue] filter ordering Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19730 · Opened Sep 15, 2026
(doc issue) permitAll/denyAll listed as "methods" in docs but are actually fields in SecurityExpressionRoot Open

status: waiting-for-triage type: bug

Difficulty 1/5 Under an hour Newbie friendliness 90/100

spring-projects/spring-security#19728 · Opened Sep 15, 2026
XML configuration tests fail with a non-English locale Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 74/100

spring-projects/spring-security#19725 · Opened Sep 15, 2026
Make the digest algorithm configurable for SAML authentication request and SAML Logout request Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19718 · Opened Sep 14, 2026
Dependabot auto-merge should not apply to minor release updates Open

in: build type: task

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19717 · Opened Sep 14, 2026
provide an interceptor in Spring Security (messaging?) that installs an `Authentication` object in a Message header given a JWT header Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

spring-projects/spring-security#19709 · Opened Sep 14, 2026
Configurable JWS algorithm for decoding an OIDC back-channel logout token Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 68/100

spring-projects/spring-security#19704 · Opened Sep 11, 2026
Slow authorization code lookup on MySQL with large oauth2_authorization table Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

spring-projects/spring-security#19703 · Opened Sep 11, 2026
Spring Authorization Server should provide native, configurable support for hashing long-lived credentials (specifically OAuth2RefreshToken) Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

spring-projects/spring-security#19698 · 4 comments · 3 reactions · Opened Sep 10, 2026
Using a custom role prefix breaks "hasRole('ANONYMOUS')" Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19673 · Opened Sep 7, 2026
Expose JWKSourceBuilder options (cache TTL, refresh-ahead, outage tolerance) on JwkSetUriJwtDecoderBuilder Open

in: oauth2

spring-projects/spring-security#19643 · 4 comments · 1 assignee · Opened Sep 3, 2026
Preserve the resource path in the default resource_metadata challenge Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 72/100

spring-projects/spring-security#19639 · Opened Sep 1, 2026
[Client] Support JWT for Client Authentication, as defined in RFC 7523 Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19638 · Opened Sep 1, 2026
Spring security becomes unusable when OpenSAML is on the module path Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 82/100

spring-projects/spring-security#19628 · Opened Aug 29, 2026
Fix for #18243 (CacheSaml2AuthenticationRequestRepository.saveAuthenticationRequest(..) throws IllegalArgumentException) is missing in 7.1.1 Open

status: waiting-for-triage type: bug

spring-projects/spring-security#19627 · 1 comment · 1 assignee · Opened Aug 28, 2026
Spring Security between 6.3.10 (exclusive) and at least 6.5.11 (inclusive) breaks SAML signature validation due to namespace hoisting Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19606 · Opened Aug 27, 2026
Make RegisteredClient.Builder methods @Nullable for @Nullable properties Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 72/100

spring-projects/spring-security#19597 · 1 comment · Opened Aug 25, 2026
InitializeUserDetailsBeanManagerConfigurer warning names wrong logger (inner class vs. suggested outer class) Open

status: waiting-for-triage

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19595 · 1 comment · Opened Aug 25, 2026
`@ClientRegistrationId` should support property placeholder resolution Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 55/100

spring-projects/spring-security#19592 · 1 comment · Opened Aug 24, 2026
InMemoryOAuth2AuthorizationService retains completed authorizations indefinitely and may cause unbounded memory growth Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

spring-projects/spring-security#19591 · Opened Aug 24, 2026
Authorization Granted Events sample cannot work as documented Open

status: waiting-for-triage

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19584 · Opened Aug 21, 2026
please make it easier to support device code flows in a CLI Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

spring-projects/spring-security#19570 · Opened Aug 20, 2026
please make it easier to support PKCE oauth flows in, for example, a desktop app Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 35/100

spring-projects/spring-security#19569 · Opened Aug 20, 2026
TokenBasedRememberMeServices::onLoginSuccess can throw a NPE when UserDetailsService::loadUserByUsername returns null. Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 78/100

spring-projects/spring-security#19535 · 2 comments · Opened Aug 12, 2026
Confusion at 'A Review of Filters' Section in the Spring Security/Servlet Applications/ Architecture. Open

status: waiting-for-triage type: enhancement

Difficulty 2/5 1-3 hours Newbie friendliness 68/100

spring-projects/spring-security#19522 · Opened Aug 11, 2026
WebTestUtils mutates a final SecurityContextHolderFilter field Open

status: waiting-for-triage

Difficulty 3/5 1-2 days Newbie friendliness 74/100

spring-projects/spring-security#19520 · Opened Aug 11, 2026
ACL parent cycle causes infinite recursion in BasicLookupStrategy.convert() Open

in: acl type: bug

spring-projects/spring-security#19513 · 1 assignee · Opened Aug 7, 2026
DefaultBearerTokenResolver rejects RFC-legal multi-space `Authorization` header Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spring-projects/spring-security#19500 · 1 comment · Opened Aug 6, 2026
Custom authorization logic when token exchange flow is triggered in Spring authorization server Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19480 · 1 reaction · Opened Jul 31, 2026
Document the end-to-end Servlet OAuth2 Login authentication flow Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 70/100

spring-projects/spring-security#19459 · Opened Jul 18, 2026
CSRF token request is same or different for every requests Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 30/100

spring-projects/spring-security#19458 · Opened Jul 18, 2026
HeaderWriterFilter headers not written on RequestDispatcher.forward() under Tomcat 11 Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 45/100

spring-projects/spring-security#19457 · Opened Jul 17, 2026
`TokenExchangeGrantRequest` sends an `OidcIdToken` subject token as `...:access_token` Open

status: waiting-for-triage type: bug

Difficulty 2/5 1-3 hours Newbie friendliness 76/100

spring-projects/spring-security#19448 · 2 comments · Opened Jul 15, 2026
Align Reactive BearerTokenServerAuthenticationEntryPoint with Servlet RFC 9728 WWW-Authenticate behavior Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 68/100

spring-projects/spring-security#19446 · 2 comments · Opened Jul 14, 2026
Token exchange: the RFC 8693 type identifiers cannot be stated by the application Open

status: waiting-for-triage type: enhancement

Difficulty 5/5 Over a week Newbie friendliness 45/100

spring-projects/spring-security#19436 · Opened Jul 11, 2026
child AuthenticationManager AuthenticationException not published as AbstractAuthenticationFailureEvent Open

status: waiting-for-triage type: bug

Difficulty 3/5 1-2 days Newbie friendliness 62/100

spring-projects/spring-security#19434 · 1 comment · 2 reactions · Opened Jul 10, 2026
Kotlin DSL Missing OAuth 2.0 Protected Resource Metadata (RFC-9728) Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 72/100

spring-projects/spring-security#19422 · 2 comments · 1 reaction · Opened Jul 8, 2026
SwitchUserFilter fails with IllegalArgumentException (currentAuthentication / source cannot be null) Open

status: waiting-for-triage type: bug

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19418 · 1 comment · Opened Jul 7, 2026
Allow to provide a `ClientHttpRequestInterceptor` for the RestClient used by OAuth2 client Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 68/100

spring-projects/spring-security#19417 · 2 comments · Opened Jul 6, 2026
Allow configuring a java.time.Clock in OAuth2Authorization.Token Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 52/100

spring-projects/spring-security#19413 · Opened Jul 2, 2026
Allow custom request context in WebAuthnAuthenticationFilter via AuthenticationConverter Open

status: waiting-for-triage type: enhancement

Difficulty 4/5 3-5 days Newbie friendliness 48/100

spring-projects/spring-security#19411 · 2 comments · Opened Jul 2, 2026
Use modern Spring LDAP APIs Open

status: waiting-for-triage type: enhancement

Difficulty 3/5 1-2 days Newbie friendliness 35/100

spring-projects/spring-security#19407 · Opened Jul 1, 2026

spring-projects/spring-security

Get new issues in your inbox