Last checked and updated on 21 May 2026
What Is New in Spring Security 6.4
| Category | Highlights |
|---|---|
| New Features | Add @FunctionalInterface to AuthorizationEventPublisher; DefaultResourcesFilter.webauthn(); Documentation for passkeys dependencies. |
| Improvements | Improved error messages for conflicting filter chains; easier to locate filter chain definitions; deprecation notice for missing leading slashes; support for ServerExchangeRejectedHandler and ServerWebExchangeFirewall beans. |
| Bug Fixes | Empty-string bearer token returns proper status; AOT support registers proxied class; OpenSAML initialization fixes; IpAddressMatcher NPE; ConcurrentModificationException in UniqueSecurityAnnotationScanner. |
| Deprecations | Missing leading slash in request matchers now deprecated. |
| Dependency Upgrades | Logback 1.5.12, Jackson 2.18.1, Webauthn4j 0.28.2, Micrometer 1.14.1, Reactor 2023.0.12, BouncyCastle 1.79, Hibernate Core 6.6.2, Spring Framework 6.2.0, and several other library bumps. |
How can I implement a functional AuthorizationEventPublisher in Spring Security 6.4?
You can implement AuthorizationEventPublisher as a functional interface using a lambda or method reference.
In practice this means you can declare a bean like:
@Bean
AuthorizationEventPublisher myPublisher() {
return (event) -> {
// custom handling logic
};
}
This reduces boilerplate and aligns the publisher with modern Java functional style.
What WebAuthn and passkey capabilities are added in Spring Security 6.4?
Spring Security now includes a DefaultResourcesFilter.webauthn() helper and documentation for passkey dependencies.
- DefaultResourcesFilter.webauthn() can be added to the filter chain to handle WebAuthn registration and authentication flows.
- The release notes point developers to the new "passkeys" documentation, clarifying required Maven coordinates (e.g., com.webauthn4j:webauthn4j-core).
- This matters if your product is moving toward password-less authentication; the built-in filter reduces custom wiring.
How have filter chain diagnostics been improved in Spring Security 6.4?
Error messages now pinpoint conflicting filter chains and the framework provides utilities to locate where a chain is defined.
- The "Conflicting Filter Chains" error now includes the exact HttpSecurity configuration class and line number.
- A new helper method makes it easier to determine the source of a filter chain, helping teams debug complex multi-module setups.
- Watch out for the deprecation notice about missing leading slashes in request matchers, which can also trigger clearer warnings.
Which critical bugs were fixed that affect token handling and SAML2 in Spring Security 6.4?
Empty bearer tokens now trigger proper HTTP status, OpenSAML is auto-initialized, and several NPEs and concurrency issues were resolved.
- An empty-string Authorization header now returns 401 instead of silently proceeding.
- OpenSamlAssertingPartyMetadataRepository now guarantees OpenSAML initialization, fixing metadata loading failures.
- IpAddressMatcher null-pointer guard added; UniqueSecurityAnnotationScanner no longer throws ConcurrentModificationException.
- These fixes improve reliability for OAuth2 resource servers and SAML2 service providers in production.
Frequently Asked Questions
Does Spring Security 6.4 require changes to existing AuthorizationEventPublisher implementations?
Most existing implementations will continue to work, but you can now replace them with a lambda because the interface is marked @FunctionalInterface.
How do I enable the new WebAuthn filter in my security configuration?
Add DefaultResourcesFilter.webauthn() to the HttpSecurity filter chain, for example http.addFilterAfter(DefaultResourcesFilter.webauthn(), SecurityContextPersistenceFilter.class).
What should I do about the deprecation of missing leading slashes in request matchers?
Update any AntPathRequestMatcher or similar configurations to include a leading '/' to avoid future breaking changes.
Which dependency version should I upgrade to for Spring Framework when moving to 6.4?
Spring Framework 6.2.0 is the baseline version bundled with Spring Security 6.4.
Is there any impact on existing OAuth2AuthorizationService implementations due to OIDC logout changes?
Only OIDC logout scenarios that rely on DefaultSaml2AuthenticatedPrincipal equality are affected; ensure your principal implements proper equals/hashCode.
How can I register a ServerWebExchangeFirewall bean in a reactive application?
Declare a @Bean of type ServerWebExchangeFirewall in your configuration class and Spring Security will auto-wire it.