Last checked and updated on 21 May 2026
What Is New in Spring Security 5.2
| Category | Highlights |
|---|---|
| New Features | RSocket security DSL, SAML2 signature enforcement, OAuth2 nonce support, Reactive Messaging argument resolvers, Clear-Site-Data documentation |
| Improvements | hasAuthority/hasAnyAuthority/denyAll in AuthorizePayloadsSpec, OAuth2User now extends OAuth2AuthenticatedPrincipal, Scheduler usage tuned for reactive managers |
| Bug Fixes | AuthNRequest destination correction, SAML response skew type fix, Jwt.Builder notBefore handling, AbstractUserDetailsReactiveAuthenticationManager scheduler disposal |
| Dependency Upgrades | Jackson 2.10.0, OpenSAML 3.4.3, Tomcat 9.0.24, Spring Data Moore, Gradle 5.6.2 |
How does Spring Security 5.2 improve RSocket authentication and authorization?
Spring Security 5.2 adds first-class RSocket support, including a dedicated DSL and default configuration.
- New
RSocketSecurityDSL withhasAuthority,anyRequestdelegating toanyExchange, and a ready-to-use "Hello RSocket" sample. - Payload-based authorization now offers
hasAuthority,hasAnyAuthority, anddenyAllmethods viaAuthorizePayloadsSpec.Access. - Reactive messaging argument resolvers (
ReactiveMessagingAuthenticationPrincipalArgumentResolverandReactiveMessagingCurrentSecurityContextPrincipalArgumentResolver) make it trivial to inject the principal into RSocket handlers.
@Bean
RSocketSecurity rsocketSecurity() {
return http
.authorizePayloads(spec -> spec
.hasAuthority("ROLE_USER")
.anyRequest().denyAll())
.build();
}
What are the key SAML2 enhancements in Spring Security 5.2?
Spring Security 5.2 hardens SAML2 processing and adds documentation to guide implementers.
- All SAML2 assertions now require signature validation by default (
SAML 2 Assertion - Always require signature validation). OpenSamlAuthenticationProviderpropagates actual validation errors instead of masking them.- Fixed a bug where the SAML response skew used the wrong type, improving time-skew handling.
- Initial SAML2 login documentation was added, giving teams a concrete starting point.
How has OAuth2/OIDC support been extended in Spring Security 5.2?
OAuth2/OIDC in 5.2 receives nonce handling, richer principal model, and more customization hooks.
- Nonce can now be added to OIDC authentication requests (
OAuth2AuthorizationRequestRedirectWebFiltercustomization). OAuth2Usernow extendsOAuth2AuthenticatedPrincipal, unifying the principal API.- Developers can customize the
OAuth2AuthorizationRequestRedirectWebFiltervia the newOAuth2LoginSpecbuilder. - Documentation added for Bearer Token propagation, RFC 8414 discovery, Clear-Site-Data header, and both JWT and opaque token usage.
http
.oauth2Login(login -> login
.authorizationRequestResolver(customResolver ->
customResolver.nonce("random-nonce-value")));
What reactive-specific APIs and performance tweaks were added in 5.2?
Spring Security 5.2 introduces several reactive-only improvements that reduce thread-blocking and simplify testing.
- New argument resolvers for reactive messaging (
ReactiveMessagingAuthenticationPrincipalArgumentResolver). AbstractUserDetailsReactiveAuthenticationManagernow disposes its defaultSchedulercorrectly, preventing resource leaks.- Reactive managers default to
Schedulers.boundedElastic()for blocking I/O, improving scalability. - Mock JWT support now ensures CSRF is not required, making unit tests less brittle.
Frequently Asked Questions
Do I need to change my existing RSocket security configuration when upgrading to Spring Security 5.2?
Most existing configurations will continue to work, but you can take advantage of the new DSL methods like hasAuthority and denyAll for finer-grained control.
How can I add a nonce to an OIDC authentication request in Spring Security 5.2?
Use the OAuth2LoginSpec builder to configure the OAuth2AuthorizationRequestRedirectWebFilter with a nonce value.
What is the new way to customize the OAuth2AuthorizationRequestRedirectWebFilter?
Call http.oauth2Login(login -> login.authorizationRequestResolver(customResolver)) where customResolver can set a nonce or other parameters.
Is there a new method to deny all access in payload-based authorization?
Yes, the AuthorizePayloadsSpec.Access interface now includes a denyAll() method that can be used in the authorizePayloads DSL.
How do I create a Jwt with a notBefore claim using the new Jwt.Builder?
Use Jwt.builder().notBefore(Instant.now()).build() to set the notBefore claim as an Instant.
Which scheduler does AbstractUserDetailsReactiveAuthenticationManager use by default after the 5.2 fix?
It now defaults to Schedulers.boundedElastic() and disposes the scheduler when the manager is destroyed.