Spring Security 5.1: What's New, Release History & EOL Status

What Is New in Spring Security 5.1

How does Spring Security 5.1 simplify password migration for existing users?

Spring Security 5.1 introduces automatic password storage upgrades through the UserDetailsPasswordService (and its reactive counterpart) so that passwords can be re-hashed transparently on successful authentication.

• Implement UserDetailsPasswordService and return an updated UserDetails with the new encoded password.
• Register the service as a bean; the framework will invoke it after a successful login if the stored password needs upgrading.

@Service
public class MyPasswordUpgradeService implements UserDetailsPasswordService {
    @Override
    public UserDetails updatePassword(UserDetails user, String newPassword) {
        // persist the new encoded password and return a fresh UserDetails
        return new User(user.getUsername(), newPassword, user.getAuthorities());
    }
}

In practice this means you can move from BCrypt to Argon2 without forcing users to reset passwords.

What new OAuth 2.0 client and resource server capabilities are available in Spring Security 5.1 for servlet and WebFlux?

Spring Security 5.1 adds full OAuth2 Client support for both servlet and WebFlux, including authorization_code and client_credentials grant types, plus JWT-based resource server handling.

• Servlet: configure spring.security.oauth2.client properties or use OAuth2AuthorizedClientManager for programmatic token acquisition.
• WebFlux: use ServerOAuth2AuthorizedClientExchangeFilterFunction with the reactive WebClient to obtain tokens automatically.
• Resource Server: add spring.security.oauth2.resourceserver.jwt to validate JWT bearer tokens without extra code.

// Example WebClient configuration for reactive OAuth2 client
WebClient client = WebClient.builder()
    .filter(new ServerOAuth2AuthorizedClientExchangeFilterFunction(
        clientRegistrationRepository, authorizedClientRepository))
    .build();

This matters if your microservices need to call downstream APIs using OAuth2 without writing custom token handling logic.

How have HTTP security headers and firewall protections been strengthened in Spring Security 5.1?

Spring Security 5.1 enhances the HTTP firewall to block verb tampering and cross-site tracing, and adds first-class support for Feature-Policy and other modern security headers.

• HTTP Firewall now validates the HTTP method against the request path and rejects unexpected verbs such as TRACE.
• Feature-Policy header can be added via the HeadersConfigurer to control browser features like fullscreen or geolocation.
• CSRF configuration now allows selective exclusion of endpoints using a RequestMatcher.

http
    .csrf(csrf -> csrf.ignoringRequestMatchers("/webhook/**"))
    .headers(headers -> headers
        .featurePolicy("geolocation 'self'; fullscreen 'none'"))
    .requestCache().disable();

Watch out for legacy proxies that might rewrite HTTP verbs; the new firewall will reject those requests early.

What testing annotation enhancements does Spring Security 5.1 introduce?

Spring Security 5.1 expands test support by allowing @WithMockUser to control when the security context is set up and enabling @WithUserDetails to work with reactive user services.

• @WithMockUser(setupBefore = TestExecutionEvent.TEST_EXECUTION) lets you initialize the mock user after JUnit's @Before methods.
• @WithUserDetails now accepts a ReactiveUserDetailsService bean, making it usable in WebFlux tests.
• Improvements to @AuthenticationPrincipal allow bean resolution and optional error handling via errorOnInvalidType.

@Test
@WithMockUser(username = "admin", roles = "ADMIN", setupBefore = TestExecutionEvent.TEST_EXECUTION)
void securedEndpointReturnsOk() {
    // test logic here
}

Most teams will see faster test setup and clearer intent when using these annotations.