Spring Security 7.1: What's New, Release History & EOL Status

What Is New in Spring Security 7.1

How can I programmatically enforce MFA conditions in Spring Security 7.1?

Spring Security 7.1 introduces when and withWhen conditions on AuthorizationManagerFactories.multiFactor() plus the AllRequiredFactorsAuthorizationManager.anyOf method, letting you compose complex MFA rules in code.

• Use when to apply MFA only for specific request matchers.
• Combine multiple factors with anyOf to accept any satisfied factor.
• Enable WebAuthn-specific MFA via @EnableMultiFactorAuthentication(when = MultiFactorCondition.WEBAUTHN_REGISTERED).

http
    .authorizeHttpRequests(authz -> authz
        .requestMatchers("/sensitive/**")
        .access(multiFactor()
            .when(request -> request.getHeader("X-Device") != null)
            .anyOf(factor -> factor.password(), factor -> factor.webauthn()))
        .anyRequest().authenticated());

What new support does Spring Security 7.1 provide for network address matching?

Spring Security 7.1 adds InetAddressMatcher, a utility that lets you match IP addresses and CIDR ranges directly in security expressions.

• Instantiate with a single address, a range, or a CIDR block.
• Use matches(InetAddress) inside AccessDecisionVoter or @PreAuthorize expressions.

InetAddressMatcher matcher = new InetAddressMatcher("192.168.0.0/16");
boolean allowed = matcher.matches(request.getRemoteAddress());

How does Spring Security 7.1 simplify OAuth2 opaque token introspection?

The new RestClientOpaqueTokenIntrospector leverages Spring's RestClient to call an introspection endpoint with minimal boilerplate.

• Configure once with the introspection URI and client credentials.
• Works out-of-the-box with both servlet and WebFlux stacks.

OpaqueTokenIntrospector introspector = new RestClientOpaqueTokenIntrospector(
    "https://auth.example.com/introspect",
    "client-id",
    "client-secret");

What updates were made to HTTP authentication handling and CORS in Spring Security 7.1?

Spring Security 7.1 now includes the charset attribute in the WWW-Authenticate header and adds a dedicated PreFlightRequestFilter for CORS pre-flight requests.

• The charset ensures clients correctly decode challenge messages.
• Register PreFlightRequestFilter early in the filter chain to handle OPTIONS requests without triggering authentication.

http
    .addFilterBefore(new PreFlightRequestFilter(), ChannelProcessingFilter.class)
    .httpBasic(basic -> basic
        .realmName("MyApp")
        .charset("UTF-8"));