Spring Security 5.3: What's New, Release History & EOL Status

What Is New in Spring Security 5.3

How does Spring Security 5.3 improve OAuth2/OIDC client and resource-server support?

Spring Security 5.3 adds dedicated success and failure handlers for OAuth2 authorization, a configurable JwtClaimValidator, and a reactive resolver for JWT issuers.

• New OAuth2AuthorizationRequest.Builder lets you add extra parameters via a consumer, simplifying custom request creation.
• Success/failure handlers (OAuth2AuthorizationSuccessHandler, OAuth2AuthorizationFailureHandler) give you a hook to store state or log events after the authorization flow.
• JwtClaimValidator enables fine-grained claim checks without writing a full JwtDecoder implementation.
• Reactive support: JwtIssuerReactiveAuthenticationManagerResolver and ReactiveJwtIssuerAuthenticationManagerResolver resolve a JWT decoder per issuer at runtime, useful for multi-tenant SaaS.
• XML namespace extensions for OAuth2 client, resource server, and login make legacy XML configuration viable again.

http
    .oauth2Login()
        .authorizationEndpoint()
            .authorizationRequestResolver(
                request -> OAuth2AuthorizationRequest.from(request)
                    .additionalParameters(params -> params.put("prompt", "consent"))
                    .build())
        .and()
    .successHandler(new MyAuthSuccessHandler())
    .failureHandler(new MyAuthFailureHandler());

What Kotlin DSL enhancements are introduced in Spring Security 5.3?

Kotlin DSL now supports role-based authorization, custom filters, and marker annotations that keep the DSL scope clean.

• authorizeRequests { hasRole("ADMIN") } mirrors the Java .hasRole method, allowing concise role checks.
• Custom filter registration: http.addFilterBefore(myFilter, UsernamePasswordAuthenticationFilter::class.java) can be expressed directly in the DSL.
• Marker annotations (@SecurityDslMarker) prevent accidental leakage of DSL functions into unrelated scopes, reducing compile-time surprises.
• Principal name can now be set on OAuth2AuthorizeRequest.Builder.principal(String), making token acquisition code more readable.

@Bean
fun securityFilterChain(http: HttpSecurity): SecurityFilterChain {
    http {
        authorizeRequests {
            authorize("/admin/**", hasRole("ADMIN"))
            authorize(anyRequest, permitAll)
        }
        oauth2Login { }
        addFilterBefore(customFilter, UsernamePasswordAuthenticationFilter::class)
    }
    return http.build()
}

How can you customize authentication events with the new DefaultAuthenticationEventPublisher?

Spring Security 5.3 makes DefaultAuthenticationEventPublisher configurable via a map and lets you define a default event type.

• Supply a map of Class<? extends AuthenticationEvent> → ApplicationEventPublisher to route specific authentication events to different listeners.
• Use the setDefaultAuthenticationEventPublisher method to emit a fallback event when no specific mapping matches.
• This flexibility is handy for audit pipelines that need distinct handling for success, failure, and interactive authentication events.

val publisher = DefaultAuthenticationEventPublisher()
publisher.setEventPublishers(
    mapOf(
        InteractiveAuthenticationSuccessEvent::class.java to successPublisher,
        AbstractAuthenticationFailureEvent::class.java to failurePublisher
    )
)
publisher.setDefaultAuthenticationEventPublisher(genericPublisher)

What new reactive JWT and opaque-token capabilities are available in Spring Security 5.3?

Reactive support now includes a dedicated resolver for JWT issuers and test utilities for opaque-token introspection.

• JwtIssuerReactiveAuthenticationManagerResolver lazily creates a ReactiveJwtDecoder per issuer, enabling multi-tenant token validation without restarting the application.
• Opaque-token reactive test support (OpaqueTokenReactiveAuthenticationManagerResolver) simplifies writing WebFlux integration tests for resource servers.
• Improved error handling differentiates token-level errors from service-level errors in NimbusOpaqueTokenIntrospector, giving clearer diagnostics.

@Bean
fun jwtResolver(): ReactiveAuthenticationManagerResolver {
    return JwtIssuerReactiveAuthenticationManagerResolver { issuer ->
        ReactiveJwtDecoders.fromIssuerLocation(issuer)
    }
}